CVE-2026-50182

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0

Description An unauthenticated Reflected Cross-Site Scripting (XSS) issue exists in the AVideo YouTubeAPI plugin. The problem occurs because the search query parameter is concatenated directly into the href attribute of pagination links within the plugin/YouTubeAPI/gallerySection.php file without proper sanitization using htmlspecialchars or urlencode.

When a victim follows a crafted URL, an injected <script> element is processed by the AVideo Layout plugin, which extracts inline scripts and moves them into a single executable block at the bottom of the page. This allows an attacker to execute arbitrary JavaScript in the victim's browser session. If the victim is an administrator, this can lead to a full administrative takeover, enabling the attacker to create users, promote accounts to admin, change configurations, or install plugins via authenticated AJAX requests.

Recommendations Update AVideo to version 29.0 or later. As a temporary mitigation, restrict access to the plugin/YouTubeAPI/gallerySection.php file or disable the YouTubeAPI plugin's gallery section by setting showGallerySection=false.