CVE-2026-50183 is a stored Cross-Site Scripting vulnerability in the WWBN AVideo platform's YouTubeAPI plugin affecting versions 29.0 and below. The plugin directly inserts the snippet.title field from the YouTube Data API into the homepage gallery markup without HTML encoding. Since the title is controlled by any YouTube uploader, an attacker can inject JavaScript code that executes in the context of any visitor's browser. When an administrator visits the affected page, the script can leverage cookie-based authentication and lack of CSRF tokens to perform privileged actions such as creating users, promoting admins, changing configurations, or installing plugins, resulting in full administrative compromise. The malicious script persists in cache for the configured timeout period and remains effective even if the malicious YouTube video is removed. The issue has been addressed in a GitHub commit, but no official patch release or vendor advisory is cited.

This vulnerability allows remote attackers to inject persistent malicious JavaScript via YouTube video titles, which executes in the browsers of all visitors to the affected AVideo homepage. The impact includes potential full administrative takeover when an administrator visits the page, enabling unauthorized administrative actions without additional CSRF protections. The vulnerability affects confidentiality and integrity of the platform by allowing attacker-controlled code execution with administrative privileges. Availability is not impacted. The CVSS 3.1 base score is 4.7 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impact.

A fix addressing this vulnerability has been committed in the AVideo GitHub repository (commit 7292129eaee5f609beae103b5cb387d55f17b877). Users should update to a version including this commit or apply the patch manually. Since no official vendor advisory or patch release is provided, check the official WWBN AVideo GitHub repository for the latest updates and apply the fix promptly. Until patched, consider disabling or restricting the YouTubeAPI plugin or sanitizing video titles before rendering to mitigate risk.