Cross-Site Scripting in WWBN AVideo Payment Confirmation Page
CVE-2026-34375

8.2HIGH

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
27 March 2026

What is CVE-2026-34375?

AVideo, an open-source video platform by WWBN, is susceptible to a Cross-Site Scripting (XSS) vulnerability in its YPTWallet Stripe payment confirmation page. In affected versions up to and including 26.0, the application directly outputs the $_REQUEST['plugin'] parameter into a JavaScript block without sufficient encoding or sanitization. This oversight allows attackers to craft malicious URLs that, when accessed by victim users, can inject arbitrary JavaScript into the page. Furthermore, this block inadvertently reveals sensitive user information, including username and password hashes, via the methods User::getUserName() and User::getUserPass(). The issue has been addressed in the latest commits, improving the security posture of the application.

Affected Version(s)

AVideo <= 26.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-p...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe...
x_refsource_MISC

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.