CVE-2026-34396
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
WWBN AVideo versions 26.0 and prior do not encode plugin configuration values before rendering in the admin panel. The jsonToFormElements() function in admin/functions.php directly interpolates user data into HTML elements, allowing arbitrary JavaScript injection.
Risk Assessment
An attacker with admin privileges or via CSRF can inject malicious script that executes whenever an admin visits the plugin configuration page, leading to session hijacking or data theft.
Recommendation
Immediately update AVideo to a patched version or apply a temporary fix by manually encoding output in the jsonToFormElements() function.
Original NVD description (English source)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo admin panel renders plugin configuration values in HTML forms without applying htmlspecialchars() or any other output encoding. The jsonToFormElements() function in admin/functions.php directly interpolates user-controlled values into textarea contents, option elements, and input attributes. An attacker who can set a plugin configuration value (either as a compromised admin or by chaining with CSRF on admin/save.json.php) can inject arbitrary JavaScript that executes whenever any administrator visits the plugin configuration page. At time of publication, there are no publicly available patches.