Stored XSS in AVideo Bookmark Plugin Chapter Names

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name parameter, and every visitor of that video executes the payload in the AVideo origin.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

AVideo's Bookmark plugin contains a stored cross-site scripting (CWE-79) vulnerability where chapter names are not properly HTML-encoded before being rendered in public watch-page HTML. A video owner can inject malicious JavaScript through the bookmark name parameter, and because the payload is stored server-side, every visitor to that video executes the attacker's script in the AVideo origin. This vulnerability has a CVSS score of 8.7 (high severity) and affects all users who visit compromised videos, making it particularly dangerous in collaborative or multi-user AVideo deployments where malicious actors can abuse their video upload privileges to conduct widespread client-side attacks.

Casky's security skills—leveraging Claude AI's extended reasoning across 754 MITRE ATT&CK-mapped techniques—detect the attack patterns behind this vulnerability by identifying TA0001 (Reconnaissance) behaviors such as probing input validation in bookmark functionality, and TA0043 (Reconnaissance) activities including payload testing and script execution validation. Practitioners using Casky would observe findings that correlate suspicious bookmark parameters with DOM-based script injection patterns, flag unencoded user input being concatenated into HTML contexts, and surface historical execution of injected payloads across visitor sessions. The platform's skill mapping would highlight the critical gap between input sanitization and output encoding, enabling practitioners to prioritize remediation of this server-side stored XSS vector and implement robust Content Security Policy (CSP) controls to mitigate execution of injected scripts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-89256.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-89256

Casky has 323 skills that investigate the attack patterns behind CVE-2026-89256. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn