CVE-2026-34396 — Cross-site Scripting in Avideo

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.0%
top 91.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Wwbn Avideo
Timeline
PublishedMar 31

Description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo admin panel renders plugin configuration values in HTML forms without applying htmlspecialchars() or any other output encoding. The jsonToFormElements() function in admin/functions.php directly interpolates user-controlled values into textarea contents, option elements, and input attributes. An attacker who can set a plugin configuration value (either as a compromised admin or by chaining with CSRF on admin/save…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDwwbn/avideo26.0
▶Packagistwwbn/avideo26.0

🔴Vulnerability Details

2
OSV
AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel↗2026-03-31
▶
GHSA
AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel↗2026-03-31
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-34396 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶