Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-88867— WWBN AVideo Stored XSS via Category Name and Icon Class

Quick assessment

Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WWBN AVideo 在包含 commit c3edcc274c389816d434acadac07ee78eaf330c1 及更早的版本中，存在一个存储型跨站脚本（Stored XSS）漏洞。 在 中，POST 参数 和 被传递给 和 ，而这些方法在存储用户输入时未进行任何消毒处理（ 仅将字符串截断为 45 个字符）。随后，分类名称作为 HTML 文本被直接输出到页面中； 则在 以及插件画廊卡片（ ）中被直接输出到 属性中。 当启用“允许用户创建新分类”（ ）选项时，任何具有 权限的已认证用户（该权限默认通过自

CVSS 8.7 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-88867

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WWBN AVideo Stored XSS via Category Name and Icon Class
Source: CVE Program / CVE List V5
Vulnerability Description
WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters `name` and `iconClass` to Category::setName() and Category::setIconClass(), which store the values without sanitization (setName only truncates to 45 characters). The category name is later echoed as HTML text and iconClass is echoed into a class attribute in view/modeYoutubeBottom.php and in Gallery cards (plugin/Gallery/functions.php). When the CustomizeUser option usersCanCreateNewCategories is enabled, any authenticated user with canUpload permission (granted by default via self-registration) can create a category containing a JavaScript payload; the payload then executes in the browser of any visitor, including administrators, who views a watch page or gallery entry for a video assigned to that category, allowing actions such as authenticated requests with the victim's session. The issue was unpatched at the time of reporting.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WWBN AVideo 0 ~ c3edcc274c389816d434acadac07ee78eaf330c1 -

II. Public POCs for CVE-2026-88867

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-88867

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-88867 (2)

Same Patch Batch · WWBN · 2026-09-10 · 12 CVEs total

CVE-2026-88869 9.3 CRITICAL AVideo AD_Server Stored XSS via log.php label parameter
CVE-2026-88866 8.7 HIGH WWBN AVideo LoginControl Stored XSS via User-Agent Header
CVE-2026-88868 8.7 HIGH AVideo LiveLinks Stored XSS via title and description fields
CVE-2026-88865 8.1 HIGH AVideo Missing Authorization via getRestream.json.php
CVE-2026-88876 7.5 HIGH AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD
CVE-2026-88874 7.5 HIGH AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass
CVE-2026-88870 7.1 HIGH WWBN AVideo LoginControl PGP Key CSRF via GET Request
CVE-2026-88873 7.1 HIGH WWBN AVideo Cross-Site Request Forgery via logArchive.json.php
CVE-2026-88872 7.1 HIGH AVideo CustomizeUser setPassword.json.php CSRF
CVE-2026-88875 4.3 MEDIUM AVideo Incomplete API Sanitization Information Disclosure
CVE-2026-88871 4.3 MEDIUM WWBN AVideo CustomizeUser setSubscribers CSRF via GET

IV. Related Vulnerabilities

Same product: AVideo
Same vendor: WWBN
Same weakness: CWE-79

V. Comments for CVE-2026-88867

No comments yet

Leave a comment