Executive brief
WWBN AVideo is a video sharing and streaming platform. When the Gallery plugin's SubCategories feature is enabled, a reflected cross-site scripting (XSS) vulnerability in the Category view allows attackers to inject malicious scripts that execute in visitors' browsers. An attacker can craft a malicious URL that, when clicked or interacted with by a user, executes arbitrary JavaScript in the context of the victim's session, potentially compromising account security or stealing sensitive data.
Technical details
A reflected XSS vulnerability exists in plugin/Gallery/view/Category.php when SubCategories are enabled. The vulnerable code echoes the getBackURL parameter directly into an href attribute without HTML encoding, failing to sanitize user input. The attack vector is network-based, requires no privileges, and user interaction is necessary (clicking the malicious link or hovering over it with an event handler payload). An attacker can exploit this by crafting a URL with a payload in the getBackURL parameter (e.g., getBackURL=%22%20onmouseover=alert(1)%20x=%22), which breaks out of the href attribute and injects arbitrary HTML/JavaScript. The vulnerability is present through commit c3edcc274c389816d434acadac07ee78eaf330c1 with no known patch at the time of reporting.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory (GHSA-j2r3-gr47-rgfm) published
- 2026-09-11: advisory: CVE-2026-89244 published on NVD