WWBN AVideo CVE-2026-105089

Attacker must hold an authenticated AVideo account that has video upload permission (PR:L) and must set a malicious value in the video's trailer1 field. Exploitation also requires victim interaction (UI:P): a user must view a page that renders trailer1 - specifically the YouPHPFlix2 templates (BigVideo.php, BigVideoButtons.php, row_info.php) or channel playlists (channelPlaylistItems.php). The payload works against default rendering because, pre-patch, these templates emitted trailer1 directly into an onclick='flixFullScreen(...)' / avideoModalIframe(...) string or an iframe src attribute with no HTML escaping and only an !empty() check. Limiting factors: requires a valid upload-capable account, requires a victim to load the attacker-influenced content, and impact is realized in the victim's browser context rather than directly on the server; affects AVideo through 29.2.0.

This is a genuinely notable but not top-tier-urgent issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/SC:H/SI:H) scores 9.3, but that score is inflated by treating the XSS as high-impact to both the vulnerable and subsequent systems. The two mitigating realities are PR:L (the attacker must already hold a legitimate account with upload permission) and UI:P (a victim must view the affected video page, channel playlist, or template), so this is not a remote-unauthenticated drive-by. There is no CISA KEV listing and no public exploit code was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis' - note that discovery/reporting by VulnCheck is a credibility signal but is distinct from active exploitation. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified from this data. The source-code diff strongly CONFIRMS the vulnerability is real and well-understood: unescaped trailer1 values flowed into onclick strings and iframe src attributes across four templates, fixed via isValidURL() plus htmlspecialchars(ENT_QUOTES). Net: a credible, patch-available stored XSS best treated as a medium-to-high remediation priority for AVideo operators that allow multiple uploaders, rather than an emergency internet-wide threat. One caveat: the vendor rates confidentiality/integrity impact High (account/session compromise of admins who view attacker content), which is plausible for stored XSS reaching privileged viewers but should be weighed against the authenticated, interaction-dependent precondition.

An attacker who holds a low-privilege account with video upload permission sets a crafted trailer1 URL containing quote/angle-bracket breakout payloads. When another user - potentially an administrator or channel owner - browses the video, channel playlist, or YouPHPFlix2 template, the unescaped value breaks out of the onclick handler or iframe src and runs attacker JavaScript in their session. No public exploit code was identified, but the mechanism is fully confirmed by the vendor patch diff.