CVE-2026-89244

WWBN AVideo through commit c3edcc27 contains a reflected XSS in plugin/Gallery/view/Category.php when the SubCategories feature is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing an attacker to inject a script that executes in a visitor's browser...

CVE-2026-89244 WWBN AVideo Reflected XSS via Gallery Category getBackURL

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...

EUVD-2026-76056

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inje...