CVE-2026-47694: WWBN AVideo Stored XSS in Category Descriptions (CVSS 5.4)

Technical summary

CVE-2026-47694 is a stored XSS vulnerability in WWBN AVideo version 29.0 and earlier. The application fails to sanitize or encode user-supplied input in the category description field before rendering it as raw HTML in the Gallery view. An authenticated attacker with category creation or edit permissions can inject arbitrary JavaScript that persists in the database and executes in the context of other users' browsers, potentially within a cross-site context depending on the deployment configuration. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Business impact

This vulnerability enables account compromise, session hijacking, and credential theft targeting your user base. Users who view an attacker-modified category page could have their session tokens or authentication cookies stolen, allowing the attacker to impersonate them or access sensitive content. For public or semi-public AVideo deployments, this expands the attack surface beyond authenticated users. Depending on integration with other services, malicious scripts could redirect users to phishing sites, deface content, or perform unauthorized actions on behalf of victims.

Affected systems

WWBN AVideo version 29.0 and all earlier versions are affected. This includes both self-hosted deployments and any managed instances running vulnerable builds. The vulnerability requires authentication to exploit, so it is limited to users or attackers with valid accounts and sufficient permissions to create or edit categories.

Exploitability

Exploitation is straightforward for an attacker with category creation or edit privileges. No special tools, complex techniques, or user interaction beyond viewing the gallery page is required. The stored nature means the attack is persistent—injected code executes every time any user visits the affected category. The CVSS 3.1 score of 5.4 (Medium) reflects the requirement for authentication and user interaction (a victim must view the gallery), but acknowledges the ease of injection and the cross-site impact potential.

Remediation

Upgrade WWBN AVideo to a patched version that properly sanitizes and encodes category description input before rendering. Verify the patch version against the official WWBN AVideo release notes or vendor advisory. As an interim measure, restrict category creation and editing permissions to highly trusted administrators, and audit existing category descriptions for suspicious JavaScript patterns or HTML tags. Enable Content Security Policy (CSP) headers to mitigate stored XSS impact by limiting script execution.

Patch guidance

Check the WWBN AVideo official repository and vendor advisory for the earliest patched version after 29.0. Apply the update through your deployment method (package manager, direct binary, or container image). If you maintain a custom fork or deployment, verify that user input sanitization functions are applied to category_description fields and that output encoding is enforced during HTML rendering in the Gallery view. Test the patch in a staging environment before production rollout.

Detection guidance

Search your AVideo database for category descriptions containing JavaScript keywords (script, onerror, onload, etc.) and HTML entities or tags. Monitor access logs for unusual patterns around category viewing or editing endpoints. Deploy a Web Application Firewall (WAF) rule to flag or block category update requests containing script-like patterns. In version 29.0 and earlier, any category description containing HTML tags or script elements should be treated as a potential indicator of compromise.

Why prioritize this

Although rated Medium severity due to authentication and user-interaction requirements, this vulnerability should be prioritized for timely remediation. Stored XSS flaws are persistent and affect entire user populations; once injected, they silently compromise anyone accessing the affected page. The ease of exploitation by any user with category permissions (even low-privilege accounts) and the potential for credential theft or lateral movement justify rapid patching. Organizations with public or multi-tenant AVideo deployments should treat this as higher priority.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a Medium severity rating. Positively impacting the score: authentication is required (PR:L), and the attack requires a user to view the gallery (UI:R). However, the attack has cross-site implications (S:C), achieves both confidentiality and integrity impact (C:L, I:L), and is trivial to execute over the network without complex conditions (AV:N, AC:L). The stored nature and persistence of the attack elevate practical risk beyond the base score in real-world deployments.

Frequently asked questions