Vulnerability details

CVE-2026-34375

WWBN AVideo

AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page

CVSS 3.1

8.2High

Official description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST['plugin']` parameter into a JavaScript block without any encoding or sanitization. The `plugin` parameter is not included in any of the framework's input filter lists defined in `security.php`, so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user. The same script block also outputs the current user's username and password hash via `User::getUserName()` and `User::getUserPass()`, meaning a successful XSS exploitation can immediately exfiltrate these credentials. Commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 fixes the issue.

CVSS scores

Score	Version	Source	Vector
8.2High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N`

Affected products

Vendor	Product	Versions	Source
WWBN	AVideo	<= 26.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768 x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-03-27
Last updated: 2026-03-31
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.3%

Probability of exploitation in 30 days

22.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')