Avideo CVE-2026-34375

WWBN AVideo versions up to 26.0 with YPTWallet Stripe payment module enabled. Remote unauthenticated attacker crafts malicious URL with plugin parameter containing JavaScript payload. Victim must click the link or visit the confirmation page.

The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) indicates network-accessible exploitation with low complexity requiring no authentication but user interaction, resulting in a score of 8.2. The high confidentiality impact (C:H) and changed scope (S:C) reflect the credential exposure risk. Attack complexity is low because crafting a malicious URL with injected JavaScript is straightforward for attackers familiar with XSS techniques. The primary constraint is the user interaction requirement (UI:R), meaning victims must click a crafted link. Real-world risk is elevated for installations with authenticated users who process payment transactions, as successful exploitation immediately compromises user credentials. No public exploit identified at time of analysis and no CISA KEV listing reduces immediate urgency, but the combination of low attack complexity, credential exposure, and patch availability makes remediation a priority for production instances.

An attacker identifies a target AVideo installation with active user accounts and crafts a malicious URL to the Stripe payment confirmation page, injecting JavaScript code into the plugin parameter that exfiltrates data to an attacker-controlled server. The attacker sends this URL via phishing email or social media to authenticated AVideo users, framing it as a legitimate payment notification or promotional offer. When a victim clicks the link while authenticated, the injected JavaScript executes in their browser context, harvesting their username and password hash exposed by User::getUserName() and User::getUserPass(), then transmitting these credentials to the attacker who can attempt offline hash cracking or session hijacking.