Cross-site scripting in AVideo - CVE-2026-50183
Published: November 11, 2026
Vulnerability identifier: #VU165921
CSH Severity: Medium
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-50183
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript in visitors' AVideo sessions, read non-HttpOnly cookies, and issue requests as those visitors.
The vulnerability exists due to missing HTML encoding in the AVideo YouTubeAPI plugin's gallerySection.php when rendering uploader-controlled YouTube video titles, resulting in stored cross-site scripting. A remote attacker can set a video title to <script>alert(2222)</script> and arrange for the video to match the operator's configured search query to execute JavaScript when visitors load a page displaying the enabled gallery.
Affected software
AVideo
How to mitigate CVE-2026-50183
Install security update from vendor's website.
AVideo - update to 29.1.0