Stored XSS Vulnerability in AVideo by WWBN

CVE-2026-47694

What is CVE-2026-47694?

AVideo, an open source video platform developed by WWBN, contains a vulnerability where user input for category descriptions is stored and later rendered as raw HTML in the Gallery view. This flaw allows users with permissions to create or edit categories to inject malicious JavaScript into the descriptions, which can execute in the browser of any user viewing the affected category page. This represents a stored XSS vulnerability, enabling potential exploitation separate from prior XSS issues in video titles or comments.

References