CVE-2026-126806 WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source Tag
CriticalCVSS 9.3
- Published
- Updated
- Exploit status
- No public exploit known
Description
WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WWBN AVideo | >= 14.3, <= 29.7.1 | No fix listed |
References
- GitHub Security Advisory (GHSA-2qq6-qfcq-jmr9) vendor-advisory
- github.com patch
- github.com technical-description
- github.com technical-description
- VulnCheck Advisory: WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source Tag third-party-advisory