CVE-2026-50182

Deferred Deferred - Pending Action

Reflected XSS in AVideo YouTubeAPI Gallery Pagination

Publication date: 2026-07-15

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo YouTubeAPI Gallery Pagination. The $_GET['search'] query parameter is concatenated directly into the href attribute of two pagination links in plugin/YouTubeAPI/gallerySection.php (lines 67 and 74) with no htmlspecialchars, no urlencode, and no allow-list check. An injected <script> element is then extracted by the AVideo Layout plugin and concatenated into a single trailing inline script block at the bottom of the page, where the browser executes it. Any unauthenticated attacker can lure a victim into following a crafted URL to execute arbitrary JavaScript under the AVideo origin, which can read non-HttpOnly cookies and issue authenticated AJAX requests as the victim, and when the victim is an administrator, it can perform any cookie-authenticated admin action (create user, promote to admin, change configuration, install plugin), escalating a single click into full administrative takeover. This issue has been patched by this commit: https://github.com/WWBN/AVideo/commit/f50fc033b7adb36f1ffd6640e7826468bdafdec3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-17

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-50182

Affected Vendors & Products

Vendor	Product	Version / Range
wwbn	avideo	to 29.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in WWBN AVideo, versions before 29.0. It occurs in the YouTubeAPI Gallery Pagination feature where the search query parameter is directly inserted into HTML without proper sanitization. This allows attackers to inject malicious JavaScript via a crafted URL, which executes in the victim's browser under the AVideo domain.

Detection Guidance

To detect this vulnerability, inspect the AVideo application for versions prior to 29.0. Check plugin/YouTubeAPI/gallerySection.php for lines 67 and 74 where the $_GET['search'] parameter is used without htmlspecialchars or urlencode. Test by crafting URLs with XSS payloads in the search parameter and observe if scripts execute.

Impact Analysis

An attacker can trick you into clicking a malicious link, executing arbitrary JavaScript in your browser. This could steal non-HttpOnly cookies, make authenticated requests on your behalf, and if you are an admin, allow full account takeover including creating users, changing settings, or installing plugins.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) by exposing personal or health-related information through cross-site scripting attacks.

Mitigation Strategies

Immediately upgrade AVideo to version 29.0 or later to apply the patch. If upgrading is not possible, remove or disable the YouTubeAPI plugin. As a temporary measure, implement input validation and output encoding for the search parameter in gallerySection.php.

Hi! I’m here to help you understand CVE-2026-50182. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70