CVE-2026-34396

🗓️ 31 Mar 2026 20:40:43Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 9 Views🌐 WEB

Stored XSS in AVideo admin panel from unescaped plugin config values enabling JavaScript in plugin settings.

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2026-34396	31 Mar 202620:40	–	attackerkb
Circl	CVE-2026-34396	27 Mar 202618:49	–	circl
CNNVD	WWBN AVideo 跨站脚本漏洞	31 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-34396 AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel	31 Mar 202620:40	–	cvelist
EUVD	EUVD-2026-17634	31 Mar 202620:40	–	euvd
Github Security Blog	AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel	31 Mar 202623:22	–	github
NVD	CVE-2026-34396	31 Mar 202621:16	–	nvd
OSV	CVE-2026-34396 AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel	31 Mar 202620:40	–	osv
OSV	GHSA-V4H7-3X43-QQW4 AVideo has Stored XSS via Unescaped Plugin Configuration Values in Admin Panel	31 Mar 202623:22	–	osv
Positive Technologies	PT-2026-29355	31 Mar 202600:00	–	ptsecurity

NVD

Vulners

Node

wwbn avideoRange≤26.0

[
  {
    "vendor": "WWBN",
    "product": "AVideo",
    "versions": [
      {
        "version": "<= 26.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/WWBN/AVideo/security/advisories/GHSA-v4h7-3x43-qqw4

Parameter	Position	Path	Description	CWE
config_value	request body	admin/save.json.php	XSS via plugin configuration values rendered into HTML without proper output encoding (textarea contents, option elements, input attributes) leading to JavaScript execution in admins visiting the plugin config page.	CWE-79

17 Jun 2026 10:39Current

6Medium risk

Vulners AI Score6

CVSS 3.16.1

EPSS0.00217

SSVC

CWE-79