CVE-2026-88867: WWBN AVideo Stored XSS via Category Name and Icon Class
WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName() and Category::setIconClass(), which store the values without sanitization (setName only truncates to 45 characters). The category name is later echoed as HTML text and iconClass is echoed into a class attribute in view/modeYoutubeBottom.php and in Gallery cards (plugin/Gallery/functions.php). When the CustomizeUser option usersCanCreateNewCategories is enabled, any authenticated user with canUpload permission (granted by default via self-registration) can create a category containing a JavaScript payload; the payload then executes in the browser of any visitor, including administrators, who views a watch page or gallery entry for a video assigned to that category, allowing actions such as authenticated requests with the victim's session. The issue was unpatched at the time of reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WWBN AVideoto a version that resolves this vulnerability.Patch commit c3edcc274c389816d434acadac07ee78eaf330c1 - Compensating control
Disable the ability for untrusted/authenticated users to create new categories (turn off CustomizeUser option usersCanCreateNewCategories) to prevent stored XSS payload creation via category name and iconClass.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when the CustomizeUser option usersCanCreateNewCategories is enabled. In that configuration, self-registered users receive canUpload permission by default and can create malicious categories.
What does an attacker need to exploit it?
The attacker needs an authenticated account with canUpload permission and must be able to create a category. They can submit a JavaScript payload through the category name or iconClass POST parameter.
When does the stored payload execute, and who can be affected?
The payload executes when a visitor views a watch page or Gallery entry for a video assigned to the malicious category. Any such visitor can be affected, including administrators, and the payload can make authenticated requests using the visitor's session.
What mitigation is available if patching is not possible?
Disable the usersCanCreateNewCategories option to prevent users from creating categories through the affected path. Review existing category names and iconClass values for untrusted or suspicious content, especially for categories assigned to videos.
Is a fix identified in the available information?
No. The issue was reported as unpatched, and the affected range includes versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1.