Executive brief
WWBN AVideo, a video sharing and streaming platform, is vulnerable to a security flaw where malicious code can be hidden in category descriptions. An attacker with permissions to manage categories can inject scripts that execute in the browsers of other users or administrators who view the gallery. This could lead to unauthorized actions being performed on behalf of users, data theft, or the compromise of administrative accounts.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in WWBN AVideo versions up to 29.0. The root cause is the lack of output encoding or sanitization of the 'category_description' field in the Gallery plugin's 'mainAreaCategory.php' view. An attacker with category creation or editing privileges can inject a malicious JavaScript payload into the description field via 'objects/categoryAddNew.json.php'. When a victim (user or administrator) views the affected Gallery or category page, the payload executes in their browser context. This can be used to hijack sessions, steal sensitive information, or perform unauthorized administrative actions. A fix involving 'htmlspecialchars()' or 'HTMLPurifier' is recommended.
Affected products
- WWBN AVideo <= 29.0
Timeline
- 2026-05-19: disclosed: Initial disclosure on GitHub
- 2026-05-29: advisory: NVD publication date
- 2026-06-04: advisory: GitHub Advisory published