CVE-2026-34739
published 2026-03-31CVE-2026-34739: WWBN AVideo is an open source video platform. In versions 26.0 and prior, the User_Location plugin's testIP.php page reflects the ip request parameter directly…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.22%
12.5th percentile
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the User_Location plugin's testIP.php page reflects the ip request parameter directly into an HTML input element without applying htmlspecialchars() or any other output encoding. This allows an attacker to inject arbitrary HTML and JavaScript via a crafted URL. Although the page is restricted to admin users, AVideo's SameSite=None cookie configuration allows cross-origin exploitation, meaning an attacker can lure an admin to a malicious link that executes JavaScript in their authenticated session. At time of publication, there are no publicly available patches.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | <= 26.0 | — |
| wwbn | avideo | 0 – 26.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
ghsa·2026-04-01
CVE-2026-34739 [MEDIUM] CWE-79 AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
## Summary
The User_Location plugin's `testIP.php` page reflects the `ip` request parameter directly into an HTML input element without applying `htmlspecialchars()` or any other output encoding. This allows an attacker to inject arbitrary HTML and JavaScript via a crafted URL. Although the page is restricted to admin users, AVideo's `SameSite=None` cookie configuration allows cross-origin exploitation, meaning an attacker can lure an admin to a malicious link that executes JavaScript in their authenticated session.
## Details
At `plugin/User_Location/testIP.php:16`, the `ip` parameter is read from the request without sanitization:
```php
$ip = $_REQUEST['ip'];
```
At line 34, the value is echoed directly in
OSV
AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
osv·2026-04-01
CVE-2026-34739 [MEDIUM] AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
## Summary
The User_Location plugin's `testIP.php` page reflects the `ip` request parameter directly into an HTML input element without applying `htmlspecialchars()` or any other output encoding. This allows an attacker to inject arbitrary HTML and JavaScript via a crafted URL. Although the page is restricted to admin users, AVideo's `SameSite=None` cookie configuration allows cross-origin exploitation, meaning an attacker can lure an admin to a malicious link that executes JavaScript in their authenticated session.
## Details
At `plugin/User_Location/testIP.php:16`, the `ip` parameter is read from the request without sanitization:
```php
$ip = $_REQUEST['ip'];
```
At line 34, the value is echoed directly in
No detection rules found.
No public exploits indexed.
2026-03-31
Published