Executive brief
WWBN AVideo is a video hosting and management platform. When the user creation feature is enabled, any registered user can create video categories with unsanitized names and icon CSS classes. An attacker can inject malicious JavaScript into a category name that executes in the browsers of all visitors—including administrators—who view videos assigned to that category, enabling session hijacking and unauthorized actions on their behalf.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the category management feature. The vulnerability exists in objects/categoryAddNew.json.php, which passes POST parameters `name` and `iconClass` directly to Category::setName() and Category::setIconClass() without sanitization. The setName() method only truncates input to 45 characters without escaping; setIconClass() assigns input unchanged. These unsanitized values are later echoed into HTML context in view/modeYoutubeBottom.php (category name as text, iconClass into a class attribute) and Gallery cards. An authenticated user with upload permissions (granted by default during self-registration when usersCanCreateNewCategories is enabled) can create a category with a JavaScript payload (e.g., `<img src=x onerror=alert(...)>`); the payload executes in the browser of any visitor viewing videos in that category. The fix requires input escaping with xss_esc() in setters and htmlspecialchars() at all echo points. The issue was unpatched at the time of disclosure.
Affected products
- WWBN AVideo up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-09-10: disclosed
- 2026-08-26: advisory: GHSA-283q-fq8j-mhv8 published