Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST['plugin']` parameter into a JavaScript block without any encoding or sanitization. The `plugin` parameter is not included in any of the framework's input filter lists defined in `security.php`, so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user. The same script block also outputs the current user's username and password hash via `User::getUserName()` and `User::getUserPass()`, meaning a successful XSS exploitation can immediately exfiltrate these credentials. Commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-27 | 1 | Disclosure1 |
| 2026-03-28 | 2 | Disclosure2 |
CVE-2026-34375 WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST['plu… https://www.cve.org/CVERecord?id=CVE-2026-34375
Post summary
The text announces a CVE (CVE-2026-34375) affecting WWBN AVideo up to version 26.0, noting a reflected request parameter on the YPTWallet Stripe payment confirmation page.
🚨*CVE* CVE-2026-34375 WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST['plu… https://www.cve.org/CVERecord?id=CVE-2026-34375 ----- Traducción: CVE-2026-34375 WWB… http://infoflow.cloud`
Post summary
The post announces CVE-2026-34375 affecting WWBN AVideo, outlining that the payment confirmation page echoes user input, but offers no PoC, exploit code, patch information, or evidence of active exploitation.
🟠 CVE-2026-34375 - High WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST['plugin']` parameter into a J... https://www.thehackerwire.com/vulnerability/CVE-2026-34375/ https://t.co/zsY7Koaa58
Post summary
The post announces CVE‑2026‑34375, revealing that the YPTWallet Stripe payment confirmation page in WWBN AVideo (≤ 26.0) echoes a user‑controlled parameter, constituting a vulnerability. No exploitation, patch, or PoC details are provided within the text.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wwbn | avideo | - | - | - |