XML Injection Vulnerability in WWBN AVideo Plugin

CVE-2026-89247

What is CVE-2026-89247?

The AVideo plugin for WWBN contains a vulnerability that allows unauthenticated attackers to exploit an XML injection flaw in the VMAP.php script. By manipulating the 'vmaps' parameter in a crafted request, attackers can insert arbitrary ad tags into the generated XML response. This leads to unauthorized ad injection within users' playback sessions, causing the video player to retrieve malicious ad URLs. The flaw arises from the lack of proper encoding for timeOffset and idTag attributes sourced from unsanitized user inputs. As of the last report, this vulnerability remains unaddressed, highlighting the importance of securing input data to prevent exploitation.

References