CVE Explorer
CVE-2026-33295
WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"AVideo","vendor":"WWBN","versions":[{"status":"affected","version":"< 26.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:97724b711504463893d6ce0f23c4a2f2932a9b8f7836f223663aefe3c7958d58 · sha256:7921a7651de27fd7… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.2,"baseSeverity":"HIGH","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:97724b711504463893d6ce0f23c4a2f2932a9b8f7836f223663aefe3c7958d58 · sha256:7921a7651de27fd7… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:97724b711504463893d6ce0f23c4a2f2932a9b8f7836f223663aefe3c7958d58 · sha256:7921a7651de27fd7… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"name":"https://github.com/WWBN/AVideo/commit/30cdd825fa5778c1d678c2402be2413b84ee4833","tags":["x_refsource_MISC"],"url":"https://github.com/WWBN/AVideo/commit/30cdd825fa5778c1d678c2402be2413b84ee4833"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:97724b711504463893d6ce0f23c4a2f2932a9b8f7836f223663aefe3c7958d58 · sha256:7921a7651de27fd7… · /containers/cna/references/1
{"name":"https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv","tags":["x_refsource_CONFIRM"],"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:97724b711504463893d6ce0f23c4a2f2932a9b8f7836f223663aefe3c7958d58 · sha256:7921a7651de27fd7… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:97724b711504463893d6ce0f23c4a2f2932a9b8f7836f223663aefe3c7958d58 · sha256:7921a7651de27fd7… · /containers/adp/0/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.