CVE-2026-82646: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WWBN AVideo

CVE-2026-82646 describes an unauthenticated reflected cross-site scripting vulnerability in WWBN AVideo's url2Embed.json.php endpoint. Attackers can craft URLs with embedded HTML metacharacters that are not properly neutralized, allowing injection of malicious scripts. These scripts execute in the context of the victim's browser session on the legitimate site domain, enabling theft of session cookies or CSRF tokens. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3. No patch or official remediation information is currently provided, and no active exploitation has been reported.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of a victim's session without authentication. This can lead to theft of sensitive session information such as cookies or CSRF tokens, potentially enabling session hijacking or unauthorized actions on behalf of the victim. The impact is limited to users who interact with maliciously crafted URLs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when clicking on untrusted URLs related to the affected endpoint. Implementing web application firewall (WAF) rules to detect and block suspicious input patterns may provide temporary mitigation.