CVE-2026-82646CWE-79cross-site-scripting

CVE-2026-82646

Medium · published August 30, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then deliver it as a legitimate-looking link on the site's own domain to execute JavaScript in victims' sessions and steal cookies or CSRF tokens.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-30T19:16Z
References (2)
https://github.com/WWBN/AVideo/security/advisories/GHSA-xg77-76mf-rw8h · [email protected]https://www.vulncheck.com/advisories/wwbn-avideo-unauthenticated-reflected-xss-via-url2embed-json-php · [email protected]
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 30 AUG 14:33Z
    WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php
    cvelistv5