Executive brief
WWBN AVideo is a video platform and content management system. The vulnerability allows attackers to inject malicious JavaScript code that executes in the context of the web application for visitors who click a link from an attacker-controlled page. An attacker can harvest session cookies, redirect users to phishing sites, deface pages, or perform actions on behalf of administrators.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability in the showAlertMessage() function within objects/functions.php. The vulnerability occurs because the function inserts the raw HTTP Referer header into a JavaScript comment block (/** ... */) without encoding or sanitization. An attacker can craft a Referer header containing the string */ to close the comment and inject arbitrary JavaScript code. The attack requires user interaction—a visitor must click a link from the attacker's page—but no authentication is required. The injected script executes in the site origin for every page that includes the footer helper. No patch is currently available.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed: GitHub security advisory published
- 2026-09-11: advisory: CVE-2026-89239 published