CVE-2026-34396 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a stored XSS caused by lack of output encoding in plugin configuration values in admin panel, letting attackers inject JavaScript executed by administrators, exploit requires setting plugin config value.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in admin context, potentially leading to full admin account compromise.

Mitigation

Update to the latest version once patches are available or apply output encoding to plugin configuration values.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-v4h7-3x43-qqw4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner