Executive brief
WWBN AVideo, an open-source video sharing platform, is vulnerable to a security flaw where malicious code can be injected into the website via a specially crafted link. If a user, particularly an administrator, clicks on this link, an attacker could take control of their session. This could lead to unauthorized actions such as creating new users, changing site configurations, or a full administrative takeover of the video platform.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in WWBN AVideo versions prior to 29.0. The vulnerability is located in `plugin/YouTubeAPI/gallerySection.php`, where the `search` GET parameter is concatenated directly into the `href` attribute of pagination links without proper sanitization or encoding. An attacker can inject a `<script>` tag which is subsequently extracted and executed by the AVideo Layout plugin's `organizeHTML()` function. While the attack requires user interaction (clicking a link), a successful exploit against an authenticated administrator can lead to full site compromise via session hijacking or unauthorized API requests. A patch is available in version 29.0.
Affected products
- WWBN AVideo < 29.0
Timeline
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date