CVE-2026-105086

HIGH 8.7

WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title

CVSS Score

8.7

EPSS Score

0.0%

EPSS Percentile

0th

WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entities and runs twice via setTitle() and save(), attackers can store markup that executes in trending, gallery, embed, and playlist pages.

CWE	CWE-79
Vendor	wwbn
Product	avideo
Published	Oct 4, 2026

Stay Ahead of the Next One

Get instant alerts for wwbn avideo

Be the first to know when new high vulnerabilities affecting wwbn avideo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

WWBN / AVideo

12.4 ≤ 29.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WWBN/AVideo/security/advisories/GHSA-q62w-927x-vhhf github.com: https://github.com/WWBN/AVideo/commit/c4b6ca95a0ae3efa09919a98879870086cff150e vulncheck.com: https://www.vulncheck.com/advisories/wwbn-avideo-12.4-through-29.2.0-stored-xss-via-double-encoded-video-title

Credits

Scott Moore - VulnCheck