Description
Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors
Published: 2026-08-28
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The All Video Share extension for Joomla contains a reflected cross‑site scripting flaw. User‑supplied input is returned to the browser without proper escaping, allowing an attacker to inject and execute arbitrary JavaScript when the input is displayed. This can enable data theft, session hijacking or other client‑side attacks.

Affected Systems

The vulnerability affects the All Video Share Joomla extension released by mrvinoth.com, with all versions from 1.0.0 through 4.5.0 susceptible.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so exploitation frequency in the wild is unknown. The flaw is not listed in the CISA KEV catalog. An attacker can trigger the issue by submitting malicious input via the extension’s web interface; no special privileges are required.

Generated by OpenCVE AI on August 28, 2026 at 14:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the All Video Share extension to a patched version (v4.5.1 or later).
  • Temporarily disable the extension if an immediate upgrade is not possible.
  • Implement input validation or output escaping for any form fields handled by the extension to prevent future injection.

Generated by OpenCVE AI on August 28, 2026 at 14:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://allvideoshare.mrvinoth.com/ cve-icon cve-icon
History

Fri, 28 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Mrvinoth.com
Mrvinoth.com all Video Share Extension For Joomla
Vendors & Products Mrvinoth.com
Mrvinoth.com all Video Share Extension For Joomla

Fri, 28 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Description Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors
Title Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Mrvinoth.com All Video Share Extension For Joomla
cve-icon MITRE

Status: PUBLISHED

Assigner: Joomla

Published:

Updated: 2026-08-28T15:05:46.531Z

Reserved: 2026-08-22T14:23:37.800Z

Link: CVE-2026-78073

cve-icon Vulnrichment

Updated: 2026-08-28T15:05:41.245Z

cve-icon NVD

Status : Deferred

Published: 2026-08-28T12:16:32.083

Modified: 2026-08-28T16:18:27.263

Link: CVE-2026-78073

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T16:12:41Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')