AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php
Date: 2026-03
Affected: composer/wwbn/avideo
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33295
CWE: CWE-79

### Summary WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. ### Details At line 59 of the affected file, the following PHP code constructs a JavaScript function call: ```php downloadURLOrAlertError(url, {}, '<?php echo $video['clean_title']; ?>.' + format, progress); ``` The `clean_title` value is echoed verbatim inside a single-quoted JavaScript string literal. No JavaScript-context escaping is applied, such as wrapping with `json_encode` or htmlspecialchars with appropriate flags. Because the value sits inside a JS string delimited by single quotes, any input containing a single quote character allows an attacker to terminate the string prematurely and inject arbitrary JavaScript expressions. The `clean_title` field is derived from user-supplied video title input, meaning any user with video creation or editing privileges can craft a malicious title. The injected script executes in the security context of whatever user loads the download page for that video, which may include administrators or authenticated users with elevated privileges. ### PoC ```python import requests target = "https://example.com" login_url = f"{tar


Mitigations:

Architectural layers (MAESTRO):