CVE-2026-50182: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WWBN AVideo
WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo YouTubeAPI Gallery Pagination. The $_GET['search'] query parameter is concatenated directly into the href attribute of two pagination links in plugin/YouTubeAPI/gallerySection.php (lines 67 and 74) with no htmlspecialchars, no urlencode, and no allow-list check. An injected <script> element is then extracted by the AVideo Layout plugin and concatenated into a single trailing inline script block at the bottom of the page, where the browser executes it. Any unauthenticated attacker can lure a victim into following a crafted URL to execute arbitrary JavaScript under the AVideo origin, which can read non-HttpOnly cookies and issue authenticated AJAX requests as the victim, and when the victim is an administrator, it can perform any cookie-authenticated admin action (create user, promote to admin, change configuration, install plugin), escalating a single click into full administrative takeover. This issue has been patched by this commit: https://github.com/WWBN/AVideo/commit/f50fc033b7adb36f1ffd6640e7826468bdafdec3.
AI Analysis
Technical Summary
CVE-2026-50182 is a reflected cross-site scripting vulnerability in WWBN AVideo prior to version 29.0. The vulnerability is located in plugin/YouTubeAPI/gallerySection.php, where the $_GET['search'] parameter is concatenated directly into href attributes of pagination links without proper encoding or validation. Injected script elements are later extracted and executed by the AVideo Layout plugin in an inline script block. Because the vulnerability is unauthenticated and allows execution of arbitrary JavaScript in the context of the AVideo origin, it enables attackers to perform actions such as reading non-HttpOnly cookies and issuing authenticated AJAX requests. If the victim has administrative privileges, the attacker can escalate to full administrative control by performing cookie-authenticated admin actions. The vulnerability is patched in version 29.0 as per the referenced GitHub commit.
Potential Impact
An unauthenticated attacker can exploit this vulnerability by tricking a victim into visiting a crafted URL containing malicious JavaScript in the 'search' parameter. This script executes in the victim's browser with the privileges of the AVideo web application origin, allowing theft of session cookies and execution of authenticated requests. For administrator victims, this can lead to full administrative takeover, including creating users, promoting users to admin, changing configurations, and installing plugins. The vulnerability does not impact availability but compromises confidentiality and integrity of the application and its data.
Mitigation Recommendations
A fix is available in WWBN AVideo version 29.0, which properly sanitizes the 'search' query parameter to prevent script injection. Users should upgrade to version 29.0 or later to remediate this vulnerability. No other mitigation guidance is provided by the vendor advisory.
CVE-2026-50182: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WWBN AVideo
Description
WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo YouTubeAPI Gallery Pagination. The $_GET['search'] query parameter is concatenated directly into the href attribute of two pagination links in plugin/YouTubeAPI/gallerySection.php (lines 67 and 74) with no htmlspecialchars, no urlencode, and no allow-list check. An injected <script> element is then extracted by the AVideo Layout plugin and concatenated into a single trailing inline script block at the bottom of the page, where the browser executes it. Any unauthenticated attacker can lure a victim into following a crafted URL to execute arbitrary JavaScript under the AVideo origin, which can read non-HttpOnly cookies and issue authenticated AJAX requests as the victim, and when the victim is an administrator, it can perform any cookie-authenticated admin action (create user, promote to admin, change configuration, install plugin), escalating a single click into full administrative takeover. This issue has been patched by this commit: https://github.com/WWBN/AVideo/commit/f50fc033b7adb36f1ffd6640e7826468bdafdec3.
CVSS v3.1
Score 6.1medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-50182 is a reflected cross-site scripting vulnerability in WWBN AVideo prior to version 29.0. The vulnerability is located in plugin/YouTubeAPI/gallerySection.php, where the $_GET['search'] parameter is concatenated directly into href attributes of pagination links without proper encoding or validation. Injected script elements are later extracted and executed by the AVideo Layout plugin in an inline script block. Because the vulnerability is unauthenticated and allows execution of arbitrary JavaScript in the context of the AVideo origin, it enables attackers to perform actions such as reading non-HttpOnly cookies and issuing authenticated AJAX requests. If the victim has administrative privileges, the attacker can escalate to full administrative control by performing cookie-authenticated admin actions. The vulnerability is patched in version 29.0 as per the referenced GitHub commit.
Potential Impact
An unauthenticated attacker can exploit this vulnerability by tricking a victim into visiting a crafted URL containing malicious JavaScript in the 'search' parameter. This script executes in the victim's browser with the privileges of the AVideo web application origin, allowing theft of session cookies and execution of authenticated requests. For administrator victims, this can lead to full administrative takeover, including creating users, promoting users to admin, changing configurations, and installing plugins. The vulnerability does not impact availability but compromises confidentiality and integrity of the application and its data.
Mitigation Recommendations
A fix is available in WWBN AVideo version 29.0, which properly sanitizes the 'search' query parameter to prevent script injection. Users should upgrade to version 29.0 or later to remediate this vulnerability. No other mitigation guidance is provided by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-03T22:05:13.644Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a57fcc868715ace4384e4ac
Added to database: 07/15/2026, 21:34:00 UTC
Last enriched: 07/22/2026, 22:54:16 UTC
Last updated: 08/29/2026, 10:52:09 UTC
Views: 83
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.