CVE-2026-33295 — Cross-site Scripting in Avideo

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
8.2HIGHNVD
EPSS
0.0%
top 98.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Wwbn Avideo
Timeline
Latest updateMar 19
PublishedMar 22

Description

WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Affected Packages2 packages

▶NVDwwbn/avideo< 26.0
▶Packagistwwbn/avideo25.0

Patches

Patch: github.com ↗

🔴Vulnerability Details

2
OSV
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php↗2026-03-19
▶
GHSA
AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php↗2026-03-19
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-33295 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶