CVE-2026-60092

The CVE-2026-60092 entry describes a stored cross-site scripting vulnerability in the AVideo Meet plugin. When a participant joins a public meeting, the raw HTTP User-Agent header is stored in meet_join_log.user_agent without sanitization and later echoed in the Participants management panel (vis...

GHSA-7CQP-7CFV-6C3Q AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

Summary The Meet plugin stores the raw HTTP User-Agent header of every meeting participant and later renders it without output encoding in the meeting-management "Participants" panel that the meeting host and site administrators open. An anonymous, unauthenticated attacker can join any public...

PT-2026-56449

Name of the Vulnerable Software and Affected Versions AVideo Meet plugin versions prior to commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 Description A stored cross-site scripting issue exists in the Meet plugin's 'getMeetInfo.json.php' endpoint. The application stores the raw HTTP User-Agent...