CVE-2026-34396 Details
Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo admin panel renders plugin configuration values in HTML forms without applying htmlspecialchars() or any other output encoding. The jsonToFormElements() function in admin/functions.php directly interpolates user-controlled values into textarea contents, option elements, and input attributes. An attacker who can set a plugin configuration value (either as a compromised admin or by chaining with CSRF on admin/save.json.php) can inject arbitrary JavaScript that executes whenever any administrator visits the plugin configuration page. At time of publication, there are no publicly available patches.
A stored cross-site scripting vulnerability has been identified in the WWBN AVideo admin panel, affecting versions through 26.0. The issue arises because plugin configuration values are rendered in HTML forms without proper output encoding. The vulnerability can be exploited by injecting arbitrary JavaScript into plugin configuration values, which is executed when an administrator visits the affected page. This vulnerability can be exploited directly by an authenticated admin or by chaining with a cross-site request forgery (CSRF) vulnerability on the 'admin/save.json.php' endpoint, allowing for exploitation without authentication.
To address this vulnerability, apply 'htmlspecialchars()' to all user-controlled values rendered in 'admin/functions.php'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-v4h7-3x43-qqw4 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-v4h7-3x43-qqw4 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 1, 2026 | Initial Analysis | [email protected] |
| Apr 1, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | New CVE Received | [email protected] |