CVE-2026-89240
Received Received - Intake

Reflected XSS in AVideo Live Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u (which is not covered by $securityFilter) directly into an <img src="..."> attribute without URL- or HTML-encoding. A remote attacker can craft a link containing a double-quote character in u (with a non-empty key parameter and no valid c parameter) to close the src attribute and inject an additional tag with an onerror handler, executing arbitrary JavaScript in the site's origin in the browser of any user, including an administrator, who opens the link. No patched version was available at the time of the advisory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89240
EUVD
EUVD-2026-76052

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89240 is a reflected cross-site scripting (XSS) vulnerability in WWBN AVideo. It exists in the plugin/Live/confirmLivePassword.php file where the unauthenticated GET parameter 'u' is directly inserted into an <img src> attribute without proper encoding. An attacker can craft a malicious link with a double-quote in 'u', a non-empty 'key' parameter, and no valid 'c' parameter to inject JavaScript via an onerror handler. This executes arbitrary code in the victim's browser within the site's origin.

Detection Guidance

To detect this vulnerability, inspect the plugin/Live/confirmLivePassword.php file in WWBN AVideo installations for improper handling of the GET parameter 'u'. Check if the parameter is directly interpolated into an img src attribute without URL or HTML encoding. Use tools like grep to search for vulnerable patterns in the codebase.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary JavaScript in your browser when you click a specially crafted link. This could lead to session hijacking, theft of cookies or sensitive data, or unauthorized actions on your behalf. Since administrators are also affected, it could compromise the entire application or server.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, unauthorized disclosure, or loss of data integrity, potentially leading to regulatory penalties and compliance failures.

Mitigation Strategies

Immediately apply input validation and output encoding to the 'u' parameter in plugin/Live/confirmLivePassword.php. Use urlencode and htmlspecialchars functions to sanitize the input before using it in the img src attribute. Since no patched version is available, this manual fix is required to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89240. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart