CVE-2026-89240

WWBN AVideo Reflected XSS via confirmLivePassword.php

Published Sep 11, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u (which is not covered by $securityFilter) directly into an <img src="..."> attribute without URL- or HTML-encoding. A remote attacker can craft a link containing a double-quote character in u (with a non-empty key parameter and no valid c parameter) to close the src attribute and inject an additional tag with an onerror handler, executing arbitrary JavaScript in the site's origin in the browser of any user, including an administrator, who opens the link. No patched version was available at the time of the advisory.

Analysis

Technical impact

WWBN AVideo includes a reflected cross‑site scripting flaw in plugin/Live/confirmLivePassword.php. The script takes the unauthenticated GET parameter u, which is not sanitized by the security filter, and interpolates it directly into an img src attribute. An attacker can inject a double‑quote and a malicious tag with an onerror handler, causing any browser that loads the crafted link—including administrators—to execute arbitrary JavaScript in the site's origin.

Affected Systems

The vulnerability affects the WWBN AVideo platform, specifically the confirmLivePassword.php file under the Live plugin. Any instance of AVideo built from commit c3edcc274c389816d434acadac07ee78eaf330c1 or any earlier version that has not applied a subsequent patch is susceptible. No specific patch version was available installations running the affected code base remain at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote: an adversary only needs to craft a URL containing a malicious u parameter and entice a user to click it. Authentication is not required for the vulnerable endpoint. The impact is confined to the victim's browser session and can lead to session hijacking, credential theft, or phishing. Due to the lack of a current public fix, the exploit is theoretically straightforward for attackers who can generate and spread malicious links.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WWBN

AVideo

unaffected

Version	Status	Constraints
`0`	affected	≤ c3edcc274c389816d434acadac07ee78eaf330c1

No data.

Vendor Product Versions

Wwbn

Avideo

Version	Status	Scheme	Platform
`[0,c3edcc274c389816d434acadac07ee78eaf330c1]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update AVideo to the latest version once a patch is released
Escape or remove the injected double‑quote in the u parameter before it is echoed into the img tag
Restrict access to confirmLivePassword.php to authenticated users or move it behind a login page
Deploy a Content Security Policy that blocks inline JavaScript to mitigate the effect of any residual XSS
Monitor web logs for anomalous request patterns that match the malicious URL structure

Generated by OpenCVE AI on September 11, 2026 at 14:09 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.313% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/WWBN/AVideo/security/advisories/GHSA-87qx-9wgx-954f
https://www.vulncheck.com/advisories/wwbn-avideo-reflected-xss-via-confirmlivepassword-php

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2026 11:30 AM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u (which is not covered by $securityFilter) directly into an <img src="..."> attribute without URL- or HTML-encoding. A remote attacker can craft a link containing a double-quote character in u (with a non-empty key parameter and no valid c parameter) to close the src attribute and inject an additional tag with an onerror handler, executing arbitrary JavaScript in the site's origin in the browser of any user, including an administrator, who opens the link. No patched version was available at the time of the advisory.
Title		WWBN AVideo Reflected XSS via confirmLivePassword.php
First Time appeared		Wwbn Wwbn avideo
Weaknesses		CWE-79
CPEs		cpe:2.3:a:wwbn:avideo:-:::::::*
Vendors & Products		Wwbn Wwbn avideo
References		https://github.com/WWBN/AVideo/security/advisories/GHSA-87qx-9wgx-954f https://www.vulncheck.com/advisories/wwbn-avideo-reflected-xss-via-confirmlivepassword-php
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}`