VulnSocial

CVE-2026-33295Disclosure(wwbn / avideo)

LOWCVSS 5.4 · MEDIUM

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

  • Prioritize remediation for wwbn avideo systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download buttons component. The `clean_title` field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page. Version 26.0 fixes the issue.

wwbn CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • avideo

Threat summary

  • Active exploitation appears in 1 classified signals
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked at 2 mentions on most recent observed day (2026-03-23)
  • 3 total mentions across 2 days

Affected systems

Vendors
wwbn
Products
avideo

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-22: 1Mentions · 2026-03-23: 2Active Exploitation · 2026-03-23: 1Technical Details · 2026-03-22: 1Technical Details · 2026-03-23: 103-2203-23
Signal classification2 categories
Disclosure
266.7%
Active Exploitation
133.3%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-03-221
Disclosure1
2026-03-232
Active Exploitation1Disclosure1
Full discourse3 posts
  • VulDB 🛡@vuldb
    Active Exploitation

    A lot of offensive activities were identified targeting WWBN AVideo (CVE-2026-33295) https://vuldb.com/?ctiid.352471

    Post summary

    The statement reports that numerous attacks targeting the CVE-2026-33295 vulnerability in WWBN AVideo have been observed, with no PoC, exploit code, or patch details provided.

    0000056
    2.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-33295 WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin's download but… https://www.cve.org/CVERecord?id=CVE-2026-33295

    Post summary

    The tweet announces CVE‑2026‑33295, detailing a stored XSS flaw in WWBN AVideo’s CDN plugin, but provides no PoC, exploit, or patch information.

    00000174
    56.8K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-33295 Stored XSS in WWBN AVideo CDN Plugin Prior to Version 26.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33295 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    The post announces a new stored XSS vulnerability in the WWBN AVideo CDN Plugin affecting versions prior to 26.0, providing basic technical details but no PoC, exploit, or patch information.

    0000058
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appwwbnavideo---

Explore more

Back to dashboardwwbn CVEsavideo vulnerabilities