CVE-2026-34375 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a stored XSS caused by unsanitized echo of the 'plugin' parameter in YPTWallet Stripe payment confirmation page JavaScript block, letting attackers inject scripts to steal user credentials, exploit requires victim to visit crafted URL.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript to steal user credentials including username and password hash.

Mitigation

Update to a version including commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 or later.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768
• https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 27, 2026

🟠 CVE-2026-34375 - High (8.2) WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST['plugin']` parameter into a JavaScript block without any encoding or sanitization. Th... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34375/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner