The vulnerability arises from an unauthenticated Reflected XSS flaw in the YouTubeAPI Gallery Pagination of WWBN AVideo. An attacker can supply a malicious payload in the $_GET['search'] parameter. The value is concatenated unescaped into the href attribute of pagination links in plugin/YouTubeAPI/gallerySection.php, which are then rendered by the AVideo Layout plugin into a single inline script block at the page bottom. Consequently, a crafted URL can cause the browser to execute arbitrary JavaScript in the context of the site. The vulnerability specifically results from concatenating the search parameter directly into two pagination link href attributes on lines 67 and 74 without any htmlspecialchars, urlencode, or allow‑list check, and a subsequent extraction of injected <script> elements by the layout plugin into a single trailing inline script block. The payload can read non‑HttpOnly cookies and make authenticated AJAX requests; if the victim is an administrator, the attacker can perform any cookie‑authenticated admin action—creating users, promoting to admin, changing configuration, installing plugins—leading to full administrative takeover.

WWBN AVideo, versions before 29.0, which include the YouTubeAPI gallery pagination component.

The CVSS base score of 6.1 indicates moderate impact, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild; the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the flaw is client‑side and requires only a crafted link, allowing any unauthenticated user to trigger it. Attackers can lure a victim, including administrators, to click a URL containing a malicious <script> within the search query. Once executed, the script can read the site’s non‑HttpOnly cookies, perform authenticated actions, and if the victim has administrative rights, assume full control of the platform.