CVE-2026-105086
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows…
- Risk score
- 55/100
- CVSS
- 8.7 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 4 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup t…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.7 high
References
- https://github.com/WWBN/AVideo/commit/c4b6ca95a0ae3efa09919a98879870086cff150e
- https://github.com/WWBN/AVideo/security/advisories/GHSA-q62w-927x-vhhf
- https://www.vulncheck.com/advisories/wwbn-avideo-12.4-through-29.2.0-stored-xss-via-double-encoded-video-title
- https://github.com/WWBN/AVideo/security/advisories/GHSA-q62w-927x-vhhf
Original description
WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup that executes in trending, gallery, embed, and playlist pages.
Last activity 4 Oct 2026. Patch Forecast updates every hour.