Executive brief
WWBN AVideo is an open-source video hosting and sharing platform. A security flaw in its administrative panel allows attackers to inject malicious scripts into the system's configuration settings. If an administrator views these settings, the script could allow the attacker to steal session information, create unauthorized accounts, or modify site content.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the AVideo admin panel due to improper output encoding in the jsonToFormElements() function within admin/functions.php. The application fails to sanitize user-controlled plugin configuration values before interpolating them into textarea, option, and input HTML elements. While setting these values typically requires administrative privileges, the vulnerability can be exploited by unauthenticated attackers by chaining it with a CSRF flaw in admin/save.json.php. Successful exploitation allows for arbitrary JavaScript execution in the context of an administrator's session, potentially leading to full site compromise. As of publication, no official patches are available.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-03-27: advisory: Vendor advisory published on GitHub
- 2026-03-31: disclosed: NVD publication date