AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php
Date: 2026-04
Affected: composer/wwbn/avideo
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-34739
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

## Summary The User_Location plugin's `testIP.php` page reflects the `ip` request parameter directly into an HTML input element without applying `htmlspecialchars()` or any other output encoding. This allows an attacker to inject arbitrary HTML and JavaScript via a crafted URL. Although the page is restricted to admin users, AVideo's `SameSite=None` cookie configuration allows cross-origin exploitation, meaning an attacker can lure an admin to a malicious link that executes JavaScript in their authenticated session. ## Details At `plugin/User_Location/testIP.php:16`, the `ip` parameter is read from the request without sanitization: ```php $ip = $_REQUEST['ip']; ``` At line 34, the value is echoed directly into an HTML input element's `value` attribute: ```php <input type="text" name="ip" id="ip" class="form-control" value="<?php echo $ip; ?>"> ``` No `htmlspecialchars()` is applied, allowing an attacker to break out of the `value` attribute and inject arbitrary HTML/JavaScript. While the page requires admin authentication to access, AVideo sets session cookies with `SameSite=None`. When an admin clicks a link from an external site (email, chat, another website), their session cookie is sent with the request, and the XSS payload executes in the context of their authenticated admin session. ## Proof of Concept 1. Craft a URL with a payload that breaks out of the input value attribute: ``` https://your-avideo-instance.com/plugin/User_Location/testIP.php?ip="><script>a


Mitigations:

Architectural layers (MAESTRO):