CVE-2026-89244: WWBN AVideo Reflected XSS via Gallery Category getBackURL
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inject malicious scripts that execute in visitors' browsers when they interact with the Back control.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WWBN AVideoto a version that resolves this vulnerability.Patch commit c3edcc274c389816d434acadac07ee78eaf330c1 - Configuration
If available, disable SubCategorys to avoid the reflected XSS in plugin/Gallery/view/Category.php.
WWBN AVideo plugin/Gallery/view/Category.php SubCategorys = enabled/disabled
Event History
Frequently Asked Questions
Who is exposed to this issue?
AVideo instances with the Gallery plugin's SubCategorys feature enabled are affected. The vulnerability is triggered when a visitor interacts with the Back control on the affected category page.
What does an attacker need to exploit it?
An attacker needs to get a victim to visit an affected page with a crafted getBackURL parameter and then interact with the Back control. No attacker privileges are indicated, but user interaction is required.
What can happen if exploitation succeeds?
Malicious script can execute in the victim's browser in the context of the affected AVideo site. The supplied severity vector indicates potential low-impact confidentiality and integrity effects, with no availability impact.