CVE-2026-34739 WWBN CVE debrief

Who should care

Administrators and users of AVideo versions 26.0 and prior should apply patches or mitigations to prevent exploitation. This vulnerability has a CVSS score of 6.1 and is classified as MEDIUM severity. The vulnerability allows attackers to inject arbitrary HTML and JavaScript via a crafted URL.

Technical summary

The User_Location plugin's testIP.php page in AVideo versions 26.0 and prior reflects the ip request parameter directly into an HTML input element without applying htmlspecialchars() or any other output encoding. This allows an attacker to inject arbitrary HTML and JavaScript via a crafted URL. Although the page is restricted to admin users, AVideo's SameSite=None cookie configuration allows cross-origin exploitation, meaning an attacker can lure an admin to a malicious link that executes JavaScript in their authenticated session.

Defensive priority

Medium priority due to the CVSS score of 6.1 and the potential for cross-origin exploitation.

Recommended defensive actions

• Apply patches or updates to AVideo versions 26.0 and prior to fix the vulnerability.
• Implement additional security measures such as input validation and output encoding.
• Monitor for suspicious activity and implement compensating controls.
• Consider changing AVideo's SameSite cookie configuration to prevent cross-origin exploitation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-03-31T21:16:32.563Z and last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. There are no publicly available patches at the time of publication. AVideo versions 26.0 and prior are affected by this vulnerability. The User_Location plugin's testIP.php page reflects the ip request parameter directly into an HTML input element without applying htmlspecialchars() or any other output encoding.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.