CVE-2026-105089: WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates
WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an AVideo account with permission to upload videos and must be able to set the video trailer1 URL to a malicious value. Exploitation also requires a victim to view affected YouPHPFlix2 template or channel playlist content.
Which deployments are exposed?
AVideo installations through version 29.2.0 are affected where the unescaped trailer1 value is rendered in YouPHPFlix2 templates or channel playlists. The provided information does not establish whether these templates are enabled by default.
What is the likely impact on a victim?
The injected value can break out of onclick strings or iframe src attributes and execute JavaScript in the victim's browser. The vulnerability is rated high with impacts to confidentiality and integrity, while availability impact is listed as none.
What can be done before patching?
Restrict upload permission to trusted users and prevent untrusted users from setting trailer1 URLs. Limit access to affected YouPHPFlix2 template and channel playlist views until the vulnerable rendering path is remediated.