Vulnerability · Published Aug 30, 2026 · Assigned by VulnCheck

CVE-2026-82646WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php

Medium 6.1

In plain English

A medium-severity cross-site scripting in AVideo from WWBN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 81.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint that allows attackers to inject malicious scripts by supplying URLs with HTML metacharacters. Attackers can mint an encrypted evideo payload containing unescaped markup, then deliver it as a legitimate-looking link on the site's own domain to execute JavaScript in victims' sessions and steal cookies or CSRF tokens.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	see references

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-xg77-76mf-rw8h) vendor-advisory
VulnCheck Advisory: WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php third-party-advisory