CVE-2026-89244 WWBN CVE debrief

Who should care

Defenders responsible for web application security, particularly those using WWBN AVideo, should be aware of this vulnerability and take steps to mitigate it. This includes verifying the presence of this vulnerability in their inventory, applying patches or mitigations, and monitoring for suspicious activity related to this vulnerability. Additionally, security teams and vulnerability management teams should also be aware of this vulnerability and its  imp

Why it matters

A reflected cross-site scripting vulnerability in WWBN AVideo allows attackers to inject malicious scripts that execute in visitors' browsers, potentially leading to browser compromise.

• Attackers may inject malicious scripts that execute in visitors' browsers
• Visitors' browsers may be compromised when interacting with the Back control
• Defenders must verify the presence of this vulnerability in their inventory and apply patches or mitigations

Technical summary

The vulnerability exists in the plugin/Gallery/view/Category.php file of WWBN AVideo when SubCategorys is enabled. The getBackURL parameter is not properly HTML encoded, allowing attackers to inject malicious scripts that execute in visitors' browsers when they interact with the Back control. This vulnerability can be mitigated by applying patches or updates to the affected software. Defenders should prioritize verifying the presence of this vulnerability in their inventory and applying patches or mitigations to prevent exploitation.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory and applying patches or mitigations to prevent exploitation.

Recommended defensive actions

• Verify the presence of this vulnerability in your inventory
• Apply patches or mitigations to prevent exploitation
• Monitor for suspicious activity related to this vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but additional information from the vendor and other sources may be necessary to fully understand the impact and mitigate the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.