CVE-2026-50182: WWBN AVideo Reflected XSS Vulnerability

CVE-2026-50182 Overview

WWBN AVideo, an open source video platform, contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability in the YouTubeAPI Gallery Pagination component. The flaw affects all versions prior to 29.0. The $_GET['search'] query parameter is concatenated directly into the href attribute of pagination links in plugin/YouTubeAPI/gallerySection.php without any encoding or sanitization. An injected <script> element is extracted by the AVideo Layout plugin and re-emitted as an inline script block that the browser executes under the AVideo origin. The vulnerability is tracked as [CWE-79] and requires user interaction to trigger.

Critical Impact
An unauthenticated attacker can lure an administrator into a crafted URL, execute arbitrary JavaScript, and escalate a single click into full administrative takeover of the AVideo instance.

Affected Products

WWBN AVideo — all versions prior to 29.0
plugin/YouTubeAPI/gallerySection.php component
AVideo Layout plugin (extracts and re-executes injected script tags)

Discovery Timeline

2026-07-15 - CVE-2026-50182 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-50182

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the YouTubeAPI gallery pagination logic. Two pagination links in plugin/YouTubeAPI/gallerySection.php on lines 67 and 74 build their href attribute by string concatenation of the raw $_GET['search'] value. The code path applies no htmlspecialchars, no urlencode, and no allow-list validation. Because the AVideo Layout plugin harvests script tags embedded in page content and re-emits them in a trailing inline <script> block, a payload placed in search is not merely rendered inside an attribute — it is extracted and executed as JavaScript. The injected script runs under the AVideo origin, granting it access to non-HttpOnly cookies and the ability to issue authenticated AJAX requests as the victim.

Root Cause

The root cause is missing output encoding on user-controlled input reflected into HTML. The search parameter flows from $_GET directly into an attribute context without escaping. A secondary design issue amplifies impact: the Layout plugin's script extraction logic converts attribute-embedded content into an executable script block.

Attack Vector

An unauthenticated attacker crafts a URL targeting the YouTubeAPI gallery pagination endpoint with a malicious search payload. The victim must click the link. When the victim is an administrator, the attacker's JavaScript can create users, promote accounts to admin, alter configuration, or install plugins using the victim's session cookies.

php

// Patch from plugin/YouTubeAPI/gallerySection.php
// Before (vulnerable):
<a href="<?php echo "{$global['webSiteRootURL']}page/".($_GET['page']-1)."?pageToken={$object->prevPageToken}&search=".(@$_GET['search']); ?>" class="btn btn-primary btn-sm pull-left">

// After (patched):
<a href="<?php echo htmlspecialchars("{$global['webSiteRootURL']}page/".(intval($_GET['page'])-1)."?pageToken=".urlencode($object->prevPageToken)."&search=".urlencode(@$_GET['search']), ENT_QUOTES | ENT_HTML5, 'UTF-8'); ?>" class="btn btn-primary btn-sm pull-left">

Source: WWBN/AVideo commit f50fc03

Detection Methods for CVE-2026-50182

Indicators of Compromise

HTTP requests to AVideo page/* routes containing search= parameters with encoded or raw <script>, onerror=, javascript:, or event-handler payloads.
Referer headers pointing to attacker-controlled domains preceding administrative actions such as user creation or plugin installation.
Unexpected admin-level API calls (create user, promote to admin, install plugin) originating from an administrator's browser session shortly after a pagination page load.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule to inspect the search query parameter for HTML metacharacters and script constructs on requests routed to the YouTubeAPI gallery.
Enable Content Security Policy (CSP) reporting to catch inline script execution violations triggered by injected payloads.
Correlate web access logs with application audit logs to identify admin actions performed within seconds of a search parameter access.

Monitoring Recommendations

Alert on any AVideo request where search contains <, >, ", or %3C sequences.
Monitor for new administrator accounts, role escalations, or plugin installations that lack a corresponding legitimate admin login event.
Log and review outbound HTTP requests from browser sessions that may indicate cookie or token exfiltration.

How to Mitigate CVE-2026-50182

Immediate Actions Required

Upgrade WWBN AVideo to version 29.0 or later, which contains the fix from commit f50fc033b7adb36f1ffd6640e7826468bdafdec3.
Instruct administrators to avoid clicking untrusted links to the AVideo instance until the patch is applied.
Rotate admin session cookies and audit administrative accounts for unauthorized changes.

Patch Information

The vulnerability is fixed in AVideo 29.0. The patch wraps the pagination href construction in htmlspecialchars with ENT_QUOTES | ENT_HTML5 and applies urlencode to the pageToken and search values, and intval to the page parameter. See the GitHub Security Advisory GHSA-hgjh-6wj8-gcgf and the remediation commit.

Workarounds

Disable the YouTubeAPI plugin until the upgrade to 29.0 is completed.
Configure a strict Content Security Policy that forbids inline scripts (script-src 'self') to neutralize reflected script execution.
Set the HttpOnly and Secure flags on session cookies to reduce the impact of client-side script access.

bash

# Example CSP header to block inline script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"

# Disable the YouTubeAPI plugin via AVideo admin CLI or by removing the plugin directory
mv /var/www/AVideo/plugin/YouTubeAPI /var/www/AVideo/plugin/YouTubeAPI.disabled