6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50182

CVE-2026-50182: WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

Unauthenticated Reflected XSS via `$_GET['search']` in AVideo YouTubeAPI Gallery Pagination

Summary

A reflected Cross-Site Scripting vulnerability (CWE-79) in the AVideo YouTubeAPI plugin allows any unauthenticated attacker to execute arbitrary JavaScript in a victim's browser session when the victim follows a crafted URL. The $_GET['search'] query parameter is concatenated directly into the href attribute of two pagination links in plugin/YouTubeAPI/gallerySection.php (lines 67 and 74) with no htmlspecialchars, no urlencode, and no allow-list check. An injected <script> element is then extracted by the AVideo Layout plugin and concatenated into a single trailing inline script block at the bottom of the page, where the browser executes it.

Details

plugin/YouTubeAPI/gallerySection.php renders the YouTubeAPI plugin's gallery section on the AVideo homepage (and every page that includes plugin/Gallery/view/mainArea.php) when the API plugin is enabled with showGallerySection=true (the default). The pagination block at lines 67 and 74 builds the previous-page and next-page <a> elements by string-interpolating $_GET['search'] directly:

// plugin/YouTubeAPI/gallerySection.php:67
<a href="<?php echo "{$global['webSiteRootURL']}page/".($_GET['page']-1)."?pageToken={$object->prevPageToken}&search=".(@$_GET['search']); ?>" ...>

// plugin/YouTubeAPI/gallerySection.php:74
<a href="<?php echo "{$global['webSiteRootURL']}page/".($_GET['page']+1)."?pageToken={$object->nextPageToken}&search=".(@$_GET['search']); ?>" ...>

The @ operator only suppresses an undefined-index warning; it does not sanitize the value. A payload like "><script>alert(1337)</script> closes the href attribute, closes the <a> element, and injects a fresh <script> tag.

Two preconditions gate the sink. First, the YouTube API call must return a pagination token (always true for any non-trivial result set, since the mock or real YouTube response carries for multi-page queries). Second, line 53 wraps the gallery render in . When is set, adds a MySQL fulltext clause; the payload tokenizes to words like , , , and the gate passes whenever any video in the corpus has a title containing one of those words. Realistic deployments overwhelmingly satisfy this; the attacker can also seed the payload with a common word () to guarantee a fulltext hit.

Miggo Vulnerability Database

→

CVE-2026-50182

CVE-2026-50182:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
WWBN/AVideo	composer	<= 29.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic reflected Cross-Site Scripting (XSS) issue. The root cause is the lack of input sanitization of the $_GET['search'] parameter in plugin/YouTubeAPI/gallerySection.php. This parameter is directly concatenated into the href attribute of pagination links, allowing an attacker to inject malicious HTML, including a <script> tag.

The exploitability of this vulnerability is significantly enhanced by the Layout::organizeHTML function in plugin/Layout/Layout.php. This function extracts all inline scripts from the generated HTML and concatenates them into a single script block at the end of the page. This means that even though the injected script is initially within an href attribute, it gets moved to a context where it will be executed by the browser.

The patch for this vulnerability, found in commit f50fc033b7adb36f1ffd6640e7826468bdafdec3, addresses the root cause by properly encoding the $_GET['search'] parameter using htmlspecialchars and urlencode before it is included in the HTML.

Vulnerable functions

Layout::organizeHTML

plugin/Layout/Layout.php

This function, while not the source of the injection, is a crucial part of the exploit chain. It takes the injected script from the `href` attribute and moves it into an executable context, making the XSS possible.

gallerySection.php

plugin/YouTubeAPI/gallerySection.php

This file contains the primary vulnerability. It directly uses the unsanitized `$_GET['search']` parameter in the `href` attribute of pagination links, allowing an attacker to inject arbitrary HTML and JavaScript. Since this is a PHP script without a specific function, the file name itself is used to identify the vulnerable code block.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-50182: WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

Unauthenticated Reflected XSS via `$_GET['search']` in AVideo YouTubeAPI Gallery Pagination

Summary

Details

CVE-2026-50182:

6.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

6.1

6.1

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

CVE-2026-50182: WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

Unauthenticated Reflected XSS via `$_GET['search']` in AVideo YouTubeAPI Gallery Pagination

Summary

Details

PoC

Impact

6.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-50182: WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

Summary

Details

CVE-2026-50182:

6.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

6.1

6.1

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Basic Information

Basic Information

CVE-2026-50182: WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination

Summary

Details

PoC

Impact

Unauthenticated Reflected XSS via `$_GET['search']` in AVideo YouTubeAPI Gallery Pagination

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Unauthenticated Reflected XSS via `$_GET['search']` in AVideo YouTubeAPI Gallery Pagination