WWBN AVideo up to 29.0 YouTubeAPI Gallery Pagination gallerySection.php Search cross site scripting

Summaryinfo

A vulnerability identified as problematic has been detected in WWBN AVideo up to 29.0. Affected by this vulnerability is an unknown functionality of the file plugin/YoutubeAPI/gallerySection.php of the component YouTubeAPI Gallery Pagination. This manipulation of the argument Search causes cross site scripting. This vulnerability appears as CVE-2026-50182. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in WWBN AVideo up to 29.0. Affected by this vulnerability is some unknown functionality of the file plugin/YoutubeAPI/gallerySection.php of the component YouTubeAPI Gallery Pagination. The manipulation of the argument search with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo YouTubeAPI Gallery Pagination. The $_GET['search'] query parameter is concatenated directly into the href attribute of two pagination links in plugin/YouTubeAPI/gallerySection.php (lines 67 and 74) with no htmlspecialchars, no urlencode, and no allow-list check. An injected <script> element is then extracted by the AVideo Layout plugin and concatenated into a single trailing inline script block at the bottom of the page, where the browser executes it. Any unauthenticated attacker can lure a victim into following a crafted URL to execute arbitrary JavaScript under the AVideo origin, which can read non-HttpOnly cookies and issue authenticated AJAX requests as the victim, and when the victim is an administrator, it can perform any cookie-authenticated admin action (create user, promote to admin, change configuration, install plugin), escalating a single click into full administrative takeover. This issue has been patched by this commit: https://github.com/WWBN/AVideo/commit/f50fc033b7adb36f1ffd6640e7826468bdafdec3.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-50182 since 06/04/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

By approaching the search of inurl:plugin/YoutubeAPI/gallerySection.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 29.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 29.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion