Medium

WWBN AVideo Reflected XSS via confirmLivePassword.php

Type: advisorySources: OSV

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u (which is not covered by $securityFilter) directly into an attribute without URL- or HTML-encoding. A remote attacker can craft a link containing a double-quote character in u (with a non-empty key parameter and no valid c parameter) to close the src attribute and inject an additional tag with an onerror handler, executing arbitrary JavaScript in the site's origin in the browser of any user, including an administrator, who opens the link. No patched version was available at the time of the advisory.

Products: Not specified
Affected versions: Not specified
Fixed versions: Not specified
CVEs: CVE-2026-89240
Confirmed fixed CVEs: Not specified
Updated in this feed: 3 Nov 2026, 16:12 UTC · Revision 1

Source evidence

WWBN AVideo Reflected XSS via confirmLivePassword.php

core-osv · Original source

Published 11 Sept 2026, 11:15 UTC

osv:CVE-2026-89240

Complete source record

{
  "id": "3077f9e4608f07822c94feaab8607e3074fdcdd8b8e9c731eedc9e32cde471e9",
  "url": "https://osv.dev/vulnerability/CVE-2026-89240",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "WWBN AVideo Reflected XSS via confirmLivePassword.php",
    "summary": "WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u (which is not covered by $securityFilter) directly into an attribute without URL- or HTML-encoding. A remote attacker can craft a link containing a double-quote character in u (with a non-empty key parameter and no valid c parameter) to close the src attribute and inject an additional tag with an onerror handler, executing arbitrary JavaScript in the site's origin in the browser of any user, including an administrator, who opens the link. No patched version was available at the time of the advisory.",
    "evidence": "osv:CVE-2026-89240",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-89240",
      "aliases": [
        "CVE-2026-89240",
        "GHSA-87qx-9wgx-954f"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/wwbn/avideo",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "c3edcc274c389816d434acadac07ee78eaf330c1"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "c3edcc274c389816d434acadac07ee78eaf330c1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "c3edcc274c389816d434acadac07ee78eaf330c1"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "29.0",
            "26.0",
            "25.0",
            "24.0",
            "22.0",
            "21.0",
            "18.0",
            "14.3.1",
            "14.3",
            "12.4",
            "11.6",
            "11.5",
            "11.1.1",
            "11.1",
            "11",
            "10.8",
            "8.9.1",
            "8.9",
            "8.7",
            "8.6",
            "8.5",
            "8.1",
            "7.8",
            "7.7",
            "7.6",
            "7.4",
            "7.3",
            "7.2",
            "4.0",
            "3.4",
            "2.7",
            "2.2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89240.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:30.160410210Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89240.json",
        "https://github.com/WWBN/AVideo/security/advisories/GHSA-87qx-9wgx-954f",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-89240",
        "https://www.vulncheck.com/advisories/wwbn-avideo-reflected-xss-via-confirmlivepassword-php"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-79"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89240.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-89240",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 497188,
  "published_at": "2026-09-11T11:15:21.65+00:00"
}