---
id: CVE-2026-89244
title: WWBN AVideo Reflected XSS via Gallery Category getBackURL
summary: >-
  WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a
  reflected cross-site scripting vulnerability in
  plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL
  parameter is echoed into an href…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: WWBN
product: AVideo
affected:
  - AVideo <= c3edcc274c389816d434acadac07ee78eaf330c1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-11T17:09:19.766759Z'
published: '2026-09-11'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T20:30:11.289Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89244'
references:
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-j2r3-gr47-rgfm'
    label: GitHub Security Advisory (GHSA-j2r3-gr47-rgfm)
  - url: >-
      https://www.vulncheck.com/advisories/wwbn-avideo-reflected-xss-via-gallery-category-getbackurl
    label: >-
      VulnCheck Advisory: WWBN AVideo Reflected XSS via Gallery Category
      getBackURL
tags:
  - cve.org
epss: 0.00164
epssPercentile: 0.0606
ingestedAt: '2026-09-14T11:11:19.882Z'
---

## Overview

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inject malicious scripts that execute in visitors' browsers when they interact with the Back control.

## Affected

- `AVideo <= c3edcc274c389816d434acadac07ee78eaf330c1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.