CVE-2026-105089: WWBN AVideo Stored XSS Vulnerability

CVE-2026-105089 Overview

CVE-2026-105089 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in WWBN AVideo through version 29.2.0. The flaw resides in the YouPHPFlix2 plugin, where the trailer1 video attribute is rendered unescaped in templates and channel playlists. Any authenticated user with upload permission can submit a crafted trailer URL that breaks out of onclick string literals or iframe src attributes to execute arbitrary JavaScript in a victim's browser. Because the payload is stored and triggered when other users view affected pages, attackers can hijack sessions, steal credentials, or perform actions in the context of administrators who visit the content.

Critical Impact
Low-privilege uploaders can plant persistent JavaScript that executes in administrator browsers, enabling full account takeover of the AVideo platform.

Affected Products

WWBN AVideo versions through 29.2.0
YouPHPFlix2 plugin component (BigVideo.php, BigVideoButtons.php)
Channel playlist rendering pages that consume the trailer1 field

Discovery Timeline

2026-10-04 - CVE-2026-105089 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-105089

Vulnerability Analysis

The vulnerability lives in the YouPHPFlix2 plugin templates that render the trailer1 property of a video object. In plugin/YouPHPFlix2/view/BigVideo.php, the value flows into an iframe src attribute. In plugin/YouPHPFlix2/view/BigVideoButtons.php, the value is embedded inside a single-quoted JavaScript string literal within an onclick handler. Neither location applied HTML entity encoding or URL validation before output. An authenticated uploader can supply a trailer1 string containing quotes, angle brackets, or javascript: schemes to escape the intended attribute context. The resulting payload is stored in the video record and served to every user who views the video, channel, or playlist page.

Root Cause

The root cause is missing output encoding and input validation on user-supplied URL data rendered into mixed HTML and JavaScript contexts. The templates called parseVideos($video['trailer1'], ...) and inlined the result directly between quotes without htmlspecialchars() or scheme validation. The patch introduces isValidURL() checks and wraps template output in htmlspecialchars(..., ENT_QUOTES, 'UTF-8') to neutralize both single and double quote breakouts.

Attack Vector

Exploitation requires an authenticated account with video upload permission and user interaction from a victim who browses the affected page. The attacker submits a video and sets the trailer field to a payload that escapes the surrounding attribute. When any user, including a privileged administrator, loads the page, the injected JavaScript runs with that user's session context. The stored nature makes the attack repeatable and scalable across the user base.

php

// Patch from plugin/YouPHPFlix2/view/BigVideo.php - adds URL validation and HTML escaping
<div class="flix-hero" id="bigVideo" style="background-image: url('<?php echo $poster; ?>');">
    <?php
-   if (!isMobile() && !empty($video['trailer1'])) {
+   if (!isMobile() && isValidURL($video['trailer1'])) {
    ?>
        <div id="bg_container">
-           <iframe src="<?php echo addQueryStringParameter(parseVideos($video['trailer1'], 1, 1, 1, 0, 0, 0, 'cover'), 'objectFit', 'cover'); ?>" frameborder="0" allowtransparency="true" allow="autoplay" tabindex="-1" aria-hidden="true"></iframe>
+           <iframe src="<?php echo htmlspecialchars(addQueryStringParameter(parseVideos($video['trailer1'], 1, 1, 1, 0, 0, 0, 'cover'), 'objectFit', 'cover'), ENT_QUOTES, 'UTF-8'); ?>" frameborder="0" allowtransparency="true" allow="autoplay" tabindex="-1" aria-hidden="true"></iframe>
        </div>

Source: GitHub Commit c4adfde

php

// Patch from plugin/YouPHPFlix2/view/BigVideoButtons.php - escapes trailer URL inside onclick JavaScript context
-   if (!empty($video['trailer1'])) {
+   if (isValidURL($video['trailer1'])) {
        ?>
-       <a href="#" class="btn btn-default" onclick="flixFullScreen('<?php echo parseVideos($video['trailer1'], 1, 0, 0, 0, 1); ?>', '');return false;">
+       <a href="#" class="btn btn-default" onclick="flixFullScreen('<?php echo htmlspecialchars(parseVideos($video['trailer1'], 1, 0, 0, 0, 1), ENT_QUOTES, 'UTF-8'); ?>', '');return false;">
            <span class="fa fa-film"></span>
            <span class=""><?php echo __("Trailer"); ?></span>
        </a>

Source: GitHub Commit c4adfde

Detection Methods for CVE-2026-105089

Indicators of Compromise

Video records whose trailer1 field contains characters such as ', ", <, >, or javascript: schemes rather than a valid HTTP(S) URL.
Outbound requests from browsers viewing AVideo pages to unexpected third-party domains that correlate with video page loads.
Administrator sessions exhibiting unexpected API calls, user creations, or permission changes shortly after viewing a channel or playlist page.

Detection Strategies

Query the AVideo database for videos.trailer1 entries that fail URL validation or contain HTML or JavaScript metacharacters.
Deploy a web application firewall rule that inspects multipart video submissions for trailer1 payloads containing script-breakout patterns.
Review web server access logs for POST requests to video create/edit endpoints followed by abnormal referrer chains on BigVideo and BigVideoButtons templates.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script violations on pages that render trailer markup.
Alert on new or modified video records submitted by non-administrator accounts, especially those populating the trailer1 field.
Audit AVideo user roles regularly and flag accounts granted upload permission without clear business justification.

How to Mitigate CVE-2026-105089

Immediate Actions Required

Upgrade WWBN AVideo to the version containing commit c4adfde13d1f18e3a415722471efdcd8ab480035 or later.
Audit existing video records and sanitize or remove any trailer1 value that is not a valid HTTP(S) URL.
Revoke upload permissions from untrusted accounts until the patch is applied and verified in all YouPHPFlix2 templates.

Patch Information

The upstream fix is published as GitHub Security Advisory GHSA-6wfr-c7fw-4xvw and committed in GitHub Commit c4adfde. The patch introduces isValidURL() validation and wraps trailer output with htmlspecialchars($value, ENT_QUOTES, 'UTF-8') in BigVideo.php and BigVideoButtons.php. See the VulnCheck Advisory for AVideo for additional detail.

Workarounds

Disable the YouPHPFlix2 plugin until the patched release can be deployed.
Apply a strict Content Security Policy that forbids inline scripts and restricts iframe sources to a trusted allowlist.
Add a server-side pre-save filter that rejects trailer1 values failing PHP filter_var($url, FILTER_VALIDATE_URL) with an HTTP/HTTPS scheme constraint.

bash

# Example server-side validation filter to enforce HTTP(S) trailer URLs
php -r '
$url = $_POST["trailer1"] ?? "";
if (!filter_var($url, FILTER_VALIDATE_URL) ||
    !in_array(parse_url($url, PHP_URL_SCHEME), ["http", "https"], true)) {
    http_response_code(400);
    exit("Invalid trailer URL");
}
'