CVE-2026-43878
Meet Plugin Reflected XSS in WWBN AVideo
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wwbn | avideo | to 29.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in WWBN AVideo, an open source video platform, in versions up to and including 29.0. The issue is in the plugin/Meet/iframe.php file, where the user and pass query parameters are inserted into a JavaScript double-quoted string literal inside a <script> block without proper escaping. Because these parameters are attacker-controlled, an attacker can craft a URL that breaks out of the string context and executes arbitrary JavaScript code in the victim's browser within the AVideo origin.
No authentication is required to exploit this vulnerability if a public Meet schedule exists on the target, making it easier for attackers to leverage.
How can this vulnerability impact me? :
This vulnerability allows an attacker to execute arbitrary JavaScript in the context of the victim's browser on the AVideo platform. This can lead to several impacts including theft of sensitive information such as cookies or session tokens, performing actions on behalf of the victim, or redirecting the victim to malicious sites.
Since no authentication is required if a public Meet schedule exists, attackers can easily exploit this vulnerability to target users without needing credentials.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update WWBN AVideo to a version later than 29.0 where the issue in plugin/Meet/iframe.php has been fixed, as indicated by commit 3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b.
Additionally, consider restricting access to public Meet schedules or disabling the affected plugin if an immediate update is not possible.