WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination # Unauthenticated Reflected XSS via `$_GET['search']` in AVideo YouTubeAPI Gallery Pagination ## Summary A reflected Cross-Site Scripting vulnerability (CWE-79) in the AVideo YouTubeAPI plugin allows any unauthenticated attacker to execute arbitrary JavaScript in a victim's browser session when the victim follows a crafted URL. The `$_GET['search']` query parameter is concatenated directly into the `href` attribute of two pagination links in `plugin/YouTubeAPI/gallerySection.php` (lines 67 and 74) with no `htmlspecialchars`, no `urlencode`, and no allow-list check. An injected `` closes the `href` attribute, closes the `` element, and injects a fresh ``) to guarantee a fulltext hit. The AVideo Layout plugin (`plugin/Layout/Layout.php:611`, enabled by default) runs `Layout::organizeHTML()` over the final HTML, extracts every inline `]*>(.*)` block via regex, and concatenates their inner contents into one trailing `` is therefore moved out of the original `href` context and into a clean executable script block; the visible pagination markup retains only the leftover `&search=">` bytes. **Affected product:** AVideo (WWBN), API + YouTubeAPI + Layout plugins **Tested version:** master branch, commit 122b184 (snapshot dated 2026-05-22) ## PoC The AVideo deployment must have the YouTubeAPI plugin enabled with the default `showGallerySection=true`. The payload also needs to satisfy the fulltext `MATCH(v.title) AGAINST` gate that `Video::getVideo()` adds when `$_GET['search']` is set: at least one video in the corpus must have a title containing one of the payload's tokens. In the live confirmation a video titled `Tutorial about script error alerts` satisfied the gate via the words `script` and `alert`. Seeding the payload with the common word `video` guarantees a hit on any realistic AVideo deployment, since `video` appears in nearly every video title. Open the following URL in any browser. No authentication, no session cookie, no prior interaction with the site is required: ``` https://avideo.example/?search=video%22%3E%3Cscript%3Ealert(1337)%3C%2Fscript%3E&page=2 ``` The browser fires an `alert(1337)` modal dialog as soon as the homepage finishes rendering. The injected `

CVE-2026-50182 Blast Radius

Is Your Infrastructure Using These Packages?