---
id: "CVE-2026-126806"
page: "https://infrastack.ai/live/CVE-2026-126806"
kind: "vulnerability"
aliases: ["CVE-2026-126806"]
title: "WWBN AVideo: stored XSS lets uploaders run scripts in admin sessions"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "WWBN AVideo", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["avideo", "other", "php", "self-hosted"]
not_affected_if: ["no-untrusted-uploaders", "version-outside-range"]
published_at: "2026-11-11T21:16:44+00:00"
first_seen_at: "2026-11-11T21:29:08+00:00"
updated_at: "2026-11-11T21:30:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126806", "first_seen_at": "2026-11-11T21:29:08+00:00"}]
exploit_sources: []
---

# WWBN AVideo: stored XSS lets uploaders run scripts in admin sessions

Link for people: https://infrastack.ai/live/CVE-2026-126806 (this .md is for agents)

AVideo versions 14.3 through 29.7.1 store the videoDownloadedLink value without escaping, so an uploader can plant event-handler script in a URL. When an administrator opens the video manager page, the script runs in their session and can be used to install a PHP plugin archive.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WWBN AVideo affected range not listed fixed no fixed version listed

## How to check

- Check the AVideo version in the installed codebase or admin panel; affected range is `14.3` through `29.7.1`.
- Review `view/managerVideos_body.php` and `objects/aVideoEncoder.json.php` for unescaped output of videoDownloadedLink.

## Fix

- Fixed version: unknown
- Vendor patch referenced in sources: GitHub patch link (version not stated in the sources given).

## Timeline

- 2026-11-11T21:29:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126806

## Documents

- [advisory] Vendor advisory: github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-2qq6-qfcq-jmr9
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/wwbn-avideo-14.3-through-29.7.1-stored-xss-via-video-source-tag
- [fix] Patch: github.com https://github.com/WWBN/AVideo/commit/da1da205608d57b1e695a7fad8288a2f5f9a0e0f

## From the sources

WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_