CVE-2026-89244 WWBN CVE debrief

Who should care

Defenders responsible for WWBN AVideo instances, particularly those with SubCategorys enabled, should assess exposure and prioritize patching and monitoring. Defenders should prioritize verifying and applying patches for AVideo, particularly for instances with SubCategorys enabled, and monitor for potential script injection attempts. This includes reviewing and updating input validation and output encoding for user-supplied data.

Why it matters

CVE-2026-89244 is a reflected cross-site scripting vulnerability in WWBN AVideo that allows attackers to inject malicious scripts. Defenders should prioritize patching and monitoring AVideo instances, particularly those with SubCategorys enabled.

• Defenders must verify and apply patches to prevent potential script injection attacks
• Instances with SubCategorys enabled are at higher risk of exploitation
• Successful exploitation could lead to malicious scripts executing in visitors' browsers

Technical summary

The vulnerability exists in the AVideo plugin/Gallery/view/Category.php file when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inject malicious scripts that execute in visitors' browsers when they interact with the Back control. This issue allows attackers to inject malicious scripts. The vulnerability is described as a reflected cross-site scripting issue in the AVideo plugin/Gallery/view/Category.php file. Defenders should prioritize verifying and applying patches for AVideo, particularly for instances with SubCategorys enabled, and monitor for potential script injection attempts.

Defensive priority

Defenders should prioritize verifying and applying patches for AVideo, particularly for instances with SubCategorys enabled, and monitor for potential script injection attempts.

Recommended defensive actions

• Verify and apply patches for AVideo, particularly for instances with SubCategorys enabled
• Monitor for potential script injection attempts
• Review and update input validation and output encoding for user-supplied data
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.3 and MEDIUM severity. The vulnerability is described as a reflected cross-site scripting issue in the AVideo plugin/Gallery/view/Category.php file.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.