CVE-2026-60092

Packagist/wwbn/avideo CVE-2026-60092: medium

AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-7cqp-7cfv-6c3q
• https://github.com/WWBN/AVideo/security/advisories/GHSA-7cqp-7cfv-6c3q
• https://github.com/WWBN/AVideo

CVE-2026-60092 · published 2026-06-23T19:11:27Z · modified 2026-09-10T03:50:48.723129694Z · JSON