Junglewise Threat Intelligence

CVE-2026-50182: WWBN AVideo reflected XSS in YouTubeAPI gallery pagination

CVE-2026-50182 · Severity: medium · CVSS 6.1 · Published 2026-07-15

Technologies: WWBN AVideo, wwbn/avideo (Packagist). Vendors: WWBN, Packagist.

Executive brief

WWBN AVideo, an open-source video sharing platform, is vulnerable to a security flaw where malicious code can be injected into the website via a specially crafted link. If a user, particularly an administrator, clicks on this link, an attacker could take control of their session. This could lead to unauthorized actions such as creating new users, changing site configurations, or a full administrative takeover of the video platform.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in WWBN AVideo versions prior to 29.0. The vulnerability is located in `plugin/YouTubeAPI/gallerySection.php`, where the `search` GET parameter is concatenated directly into the `href` attribute of pagination links without proper sanitization or encoding. An attacker can inject a `<script>` tag which is subsequently extracted and executed by the AVideo Layout plugin's `organizeHTML()` function. While the attack requires user interaction (clicking a link), a successful exploit against an authenticated administrator can lead to full site compromise via session hijacking or unauthorized API requests. A patch is available in version 29.0.

Affected products

  • WWBN AVideo < 29.0

Timeline

  • 2026-05-28: advisory: GitHub Security Advisory published
  • 2026-07-15: disclosed: NVD publication date

References

Related threats