CVE-2026-33295

MEDIUM

5.4

Description

WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.

CVE Details

CVSS v3.1 Score5.4

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionREQUIRED

Published3/22/2026

Last Modified3/24/2026

Sourcenvd

Honeypot Sightings0

Affected Products

wwbn:avideo

Weaknesses (CWE)

CWE-79

References

https://github.com/WWBN/AVideo/commit/30cdd825fa5778c1d678c2402be2413b84ee4833(security-advisories@github.com)

https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv(security-advisories@github.com)

https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.