CVE-2026-33295

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WWBN	AVideo	< 26.0

References

https://github.com/WWBN/AVideo/commit/30cdd825fa5778c1d678c2402be2413b84ee4833Patch
https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pvExploit, Vendor Advisory
https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pvExploit, Vendor Advisory

Timeline

Published: Mar 22, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-332966.1WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow w CVE-2026-332979.1WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows CVE-2026-332987.8llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml_nbytes` function al CVE-2026-332995.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `N CVE-2026-33304.9The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', CVE-2026-333006.5Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2 CVE-2026-333018.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `CVE-2026-333028.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the module ACL fu CVE-2026-333035.4OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 are vulne CVE-2026-333046.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization CVE-2026-333055.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization CVE-2026-333067.5bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm. Prior to version 3.1.22, an integer overflow in the Java