Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a classic reflected Cross-Site Scripting (XSS) issue. The root cause is the lack of input sanitization of the $_GET['search'] parameter in plugin/YouTubeAPI/gallerySection.php. This parameter is directly concatenated into the href attribute of pagination links, allowing an attacker to inject malicious HTML, including a <script> tag.
The exploitability of this vulnerability is significantly enhanced by the Layout::organizeHTML function in plugin/Layout/Layout.php. This function extracts all inline scripts from the generated HTML and concatenates them into a single script block at the end of the page. This means that even though the injected script is initially within an href attribute, it gets moved to a context where it will be executed by the browser.
The patch for this vulnerability, found in commit f50fc033b7adb36f1ffd6640e7826468bdafdec3, addresses the root cause by properly encoding the $_GET['search'] parameter using htmlspecialchars and urlencode before it is included in the HTML.
Layout::organizeHTMLplugin/Layout/Layout.php
gallerySection.phpplugin/YouTubeAPI/gallerySection.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| WWBN/AVideo | composer | <= 29.0 |