EUVD-2026-81279

In AVideo through 29.0, the autoCSRFGuard function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionall...

CVE-2026-92579

AVideo through version 29.0 is affected by a broken access control flaw in its autoCSRFGuard() function. The function maintains a hardcoded allowlist of exempt basenames that are tested without directory context, meaning plugin files whose filenames match core filenames inadvertently inherit CSRF...