CVE-2026-50183 is a stored Cross-Site Scripting vulnerability in the WWBN AVideo platform's YouTubeAPI plugin affecting versions 29.0 and below. The plugin directly inserts the snippet.title field from the YouTube Data API into the homepage gallery markup without HTML encoding. Since the video title is controlled by any YouTube uploader, an attacker can inject JavaScript code that executes in the context of any visitor's browser. When an administrator visits the affected page, the script can leverage cookie-based authentication and lack of CSRF tokens to perform privileged administrative actions, including user creation, privilege escalation, configuration changes, and plugin installation. The injected script persists for the duration of the cacheTimeout (default 3600 seconds) and remains effective even after the malicious video is removed from YouTube. The issue is addressed by a specific commit on the AVideo GitHub repository, but no official patch or release is explicitly stated.

The vulnerability allows remote attackers to inject persistent JavaScript code into the AVideo homepage via manipulated YouTube video titles. This code executes in the browsers of all visitors who load the gallery, potentially leading to theft of user credentials or session cookies. For administrators, the impact escalates to full administrative takeover, enabling unauthorized creation and promotion of users, configuration changes, and plugin installations. The persistence of the payload in cache increases the attack window. The CVSS score is 4.7 (medium severity), reflecting the need for user interaction and the complexity of exploitation due to high attack complexity.

No official patch or release is explicitly documented in the provided data. However, the vulnerability has been addressed by a commit in the AVideo GitHub repository (https://github.com/WWBN/AVideo/commit/7292129eaee5f609beae103b5cb387d55f17b877). Users should apply this fix or update to a version including this commit once available. Until then, administrators should consider restricting access to the affected plugin or disabling the YouTubeAPI plugin to mitigate risk. Monitor the vendor's official channels for an official patch or release announcement. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.