CVE-2026-88867 WWBN AVideo Stored XSS via Category Name and Icon Class
Authenticated users can inject JavaScript via category names, leading to session hijacking of administrators viewing affected content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-88867?
CVE-2026-88867 is a critical cross-site scripting vulnerability in WWBN AVideo, published on 10 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters `name` and `iconClass` to Category::setName() and Category::setIconClass(), which store the values without sanitization (setName only truncates to 45 characters). The category name is later echoed as HTML text and iconClass is echoed into a class attribute in view/modeYoutubeBottom.php and in Gallery cards (plugin/Gallery/functions.php). When the CustomizeUser option usersCanCreateNewCategories is enabled, any authenticated user with canUpload permission (granted by default via self-registration) can create a category containing a JavaScript payload; the payload then executes in the browser of any visitor, including administrators, who views a watch page or gallery entry for a video assigned to that category, allowing actions such as authenticated requests with the victim's session. The issue was unpatched at the time of reporting.
Weakness: CWE-79
Which versions are affected by CVE-2026-88867?
How do I fix CVE-2026-88867?
No fix has been published for CVE-2026-88867 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-88867 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88867 exists.
Sources
Also known as GHSA-283q-fq8j-mhv8, GHSA-7hv8-vvv8-r6qq.