Stored Cross-Site Scripting in WWBN AVideo by WWBN

CVE-2026-126810

What is CVE-2026-126810?

WWBN AVideo versions 29.1.0 through 29.7.1 are susceptible to a stored cross-site scripting vulnerability that allows registered users to inject malicious markup via the 'About' field in the channel settings. This injection exploits the 'feed/index.php' endpoint and circumvents the 'feedHtmlDescription()' filtering mechanism. As a result, any visitor, including administrators, who views the affected channel feed may unknowingly execute unquoted event-handler payloads, posing significant security risks. This vulnerability highlights the importance of properly sanitizing user input and managing permissions to protect against such attacks.

References