CVE-2025-36548 is a High severity (CVSS 8.3) cross-site scripting flaw in WWBN AVideo 14.4 and dev master commit 8a8954ff. The cancelUri parameter of the LoginWordPress loginForm is the entry point. I could not confirm a fixed version, so check the project and the Talos report.
What's affected
The record names WWBN AVideo 14.4 and the development master commit 8a8954ff. Talos, which reported the issue as TALOS-2025-2208, is the source for those details.
I could not load the Talos page from my environment, and the record does not name a fixed release. Do not assume that a later version is safe without checking. Look at the AVideo release notes and the commit history for the LoginWordPress login form, and read the Talos report for its timeline and vendor status.
How to check if you're exposed
AVideo is a self hosted video platform, so the first question is whether you run it. Check the version shown in your admin area or in the project files on the server, and compare it with 14.4 and the development build named above.
Then check whether the LoginWordPress login form is reachable. If you cannot patch yet, consider whether it is enabled at all, and whether a web application firewall in front of the site can filter the cancelUri parameter.
What to do now
- Inventory AVideo installs, including staging copies and forks, and record their versions.
- Read the Talos report TALOS-2025-2208 and the AVideo repository for the fixing change, then upgrade to a release that contains it.
- If you cannot upgrade, disable the WordPress login integration if you do not use it.
- Add a Content Security Policy that restricts inline script, to reduce the impact of any reflected script.
- Tell administrators not to follow login links from untrusted sources while you are exposed.
Why it matters
This is CWE-79 (Cross-site Scripting). The loginForm takes a cancelUri value and places it into the page without handling it safely, so a crafted request can run script in the visitor's browser. According to the record, the attacker needs the user to visit a webpage to trigger it.
The vector is network, high complexity, no privileges, user interaction required, with a changed scope and high impact. The changed scope reflects that script runs in the context of the victim's session on the site, so an administrator who is tricked can lose control of the platform.
The record does not list the CVE as exploited. Reflected script flaws in login pages deserve attention because the people who see the page are the ones with accounts.
Quick check
Is there a confirmed fixed version?
Not in the sources I could read. Check the Talos report and the AVideo repository before relying on any version number.
Who is at risk?
Users who can be lured to a crafted link on a site running AVideo 14.4 or the named development commit.
Sources
Last reviewed: 18 October 2026.
