CVE-2026-89240: WWBN AVideo Reflected XSS via confirmLivePassword.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u (which is not covered by $securityFilter) directly into an <img src="..."> attribute without URL- or HTML-encoding. A remote attacker can craft a link containing a double-quote character in u (with a non-empty key parameter and no valid c parameter) to close the src attribute and inject an additional tag with an onerror handler, executing arbitrary JavaScript in the site's origin in the browser of any user, including an administrator, who opens the link. No patched version was available at the time of the advisory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WWBN AVideoto a version that resolves this vulnerability.Patch c3edcc274c389816d434acadac07ee78eaf330c1 - Compensating control
Apply an XSS mitigation by ensuring the unauthenticated GET parameter u is URL-encoded and HTML-encoded before interpolating it into the <img src="..."> attribute in plugin/Live/confirmLivePassword.php (the issue occurs because u is inserted directly into the src attribute without URL- or HTML-encoding).
Event History
Frequently Asked Questions
Who can be targeted, and does the attacker need an account?
Any user who opens a crafted link can be targeted, including administrators. The attacker does not need authentication; exploitation uses the unauthenticated u GET parameter.
What conditions are required for exploitation?
The victim must be persuaded to open a malicious link. The request must include a non-empty key parameter, omit a valid c parameter, and place a double-quote character in u so the attacker can break out of the image src attribute and inject an onerror handler.
What is the impact if the link is opened by an administrator?
Arbitrary JavaScript can execute in the site's origin in the administrator's browser. The available information identifies confidentiality and integrity impact as low, but does not specify particular actions or data an injected script can access.
Is a patch available?
No patched version was available at the time of the advisory. The affected scope is stated as WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.