{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"29.0"}],"component":"wwbn/avideo","cve_ids":["CVE-2026-60092"],"ecosystem":"Packagist","epss":0.00253,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-7cqp-7cfv-6c3q","id":"tcs_01M5KEXYQQHFDT7BSCTVRC9M1N","modified_at":"2026-09-10T03:50:48.723129694Z","published_at":"2026-06-23T19:11:27Z","references":["https://osv.dev/vulnerability/GHSA-7cqp-7cfv-6c3q","https://github.com/WWBN/AVideo/security/advisories/GHSA-7cqp-7cfv-6c3q","https://github.com/WWBN/AVideo"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-7cqp-7cfv-6c3q","url":"https://osv.dev/vulnerability/GHSA-7cqp-7cfv-6c3q"}],"summary":"AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel"}