CVE-2026-33295: AVideo Affected by Stored XSS via Unescaped Video Title in CDN downloadButtons.php

March 19, 2026 (updated March 25, 2026)

WWBN/AVideo contains a stored cross-site scripting vulnerability in the CDN plugin’s download buttons component. The clean_title field of a video record is interpolated directly into a JavaScript string literal without any escaping, allowing an attacker who can create or modify a video to inject arbitrary JavaScript that executes in the browser of any user who visits the affected download page.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/commit/30cdd825fa5778c1d678c2402be2413b84ee4833
github.com/WWBN/AVideo/security/advisories/GHSA-gc3m-4mcr-h3pv
github.com/advisories/GHSA-gc3m-4mcr-h3pv
nvd.nist.gov/vuln/detail/CVE-2026-33295

Code Behaviors & Features

Detect and mitigate CVE-2026-33295 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →