CVE-2026-89239 - WWBN AVideo Reflected XSS via Referer Header Comment Breakout

Back Back to CVE browser

MEDIUM

WWBN AVideo Reflected XSS via Referer Header Comment Breakout

Published Sep 11, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.26%

Description

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage() function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing */ to close the comment and inject arbitrary JavaScript that executes in the site origin for visitors arriving from the attacker-controlled page.

Affected products

Vendor WWBN Product AVideo Default
unaffected
- Version
  0
  Status
  affected
  Constraints

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

WWBN

AVideo

unaffected

Version	Status	Constraints
0	affected

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://github.com/WWBN/AVideo/security/advisories/GHSA-3pp9-g99w-qw3j
vendor-advisory
https://www.vulncheck.com/advisories/wwbn-avideo-reflected-xss-via-referer-header-comment-breakout
third-party-advisory

Link	Providers	Tags
https://github.com/WWBN/AVideo/security/advisories/GHSA-3pp9-g99w-qw3j		vendor-advisory
https://www.vulncheck.com/advisories/wwbn-avideo-reflected-xss-via-referer-header-comment-breakout		third-party-advisory