CVE-2026-88867
Deferred Deferred - Pending Action

Stored XSS in AVideo with Category Creation

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters `name` and `iconClass` to Category::setName() and Category::setIconClass(), which store the values without sanitization (setName only truncates to 45 characters). The category name is later echoed as HTML text and iconClass is echoed into a class attribute in view/modeYoutubeBottom.php and in Gallery cards (plugin/Gallery/functions.php). When the CustomizeUser option usersCanCreateNewCategories is enabled, any authenticated user with canUpload permission (granted by default via self-registration) can create a category containing a JavaScript payload; the payload then executes in the browser of any visitor, including administrators, who views a watch page or gallery entry for a video assigned to that category, allowing actions such as authenticated requests with the victim's session. The issue was unpatched at the time of reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88867
EUVD
EUVD-2026-75417

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to c3edcc274c389816d434acadac07ee78eaf330c1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88867 is a stored cross-site scripting (XSS) vulnerability in WWBN AVideo software. It occurs because the category name and iconClass fields are stored without proper sanitization and later echoed raw on video pages. An attacker with upload privileges can inject malicious JavaScript into these fields. When users visit a video in the affected category, the payload executes in their browser, potentially stealing session cookies or performing unauthorized actions.

Detection Guidance

Check if AVideo is installed and verify the version is up to commit c3edcc274c389816d434acadac07ee78eaf330c1 or earlier. Inspect the objects/categoryAddNew.json.php file for unsanitized handling of name and iconClass POST parameters. Look for categories with suspicious names or iconClass values containing JavaScript payloads.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the browsers of anyone viewing videos in a compromised category. This could lead to session hijacking, where attackers steal user credentials or perform actions on behalf of victims. Administrators are particularly at risk as their elevated privileges could be exploited to gain full control of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. It may result in data breaches, unauthorized disclosures, and failure to maintain confidentiality, leading to legal penalties and reputational damage.

Mitigation Strategies

Disable the usersCanCreateNewCategories setting in CustomizeUser options. Remove canUpload permissions from non-trusted users. Review all categories for malicious payloads in name or iconClass fields. Monitor network traffic for unauthorized actions from affected users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88867. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart