AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel
Date: 2026-03
Affected: composer/wwbn/avideo
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-34396
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

## Summary The AVideo admin panel renders plugin configuration values in HTML forms without applying `htmlspecialchars()` or any other output encoding. The `jsonToFormElements()` function in `admin/functions.php` directly interpolates user-controlled values into textarea contents, option elements, and input attributes. An attacker who can set a plugin configuration value (either as a compromised admin or by chaining with CSRF on `admin/save.json.php`) can inject arbitrary JavaScript that executes whenever any administrator visits the plugin configuration page. This vulnerability chains with AVI-046 (CSRF on `save.json.php`) to enable a full cross-origin stored XSS attack against the admin panel without requiring any prior authentication. ## Details The `jsonToFormElements()` function in `admin/functions.php` contains multiple unsafe output points where configuration values are rendered without escaping: **Textarea injection (line 47):** ```php // admin/functions.php:47 $html .= "<textarea class='form-control' name='{$name}' id='{$id}'>{$valueJson->value}</textarea>"; ``` The `$valueJson->value` is placed directly between textarea tags without encoding. **Select option injection (line 55):** ```php // admin/functions.php:55 $html .= "<option value='{$key}' {$select}>{$value}</option>"; ``` Both `$key` and `$value` are inserted without encoding, allowing attribute breakout and HTML injection. **Input type and value injection (lines 62-63):** ```php // admin/functions.php


Mitigations:

Architectural layers (MAESTRO):