CVE-2026-126806

HIGH 8.7

WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source Tag

CVSS Score

8.7

EPSS Score

0.0%

EPSS Percentile

0th

WWBN AVideo 14.3 through 29.7.1 contains a stored cross-site scripting vulnerability that allows uploaders to inject scripts via the videoDownloadedLink value stored unescaped through objects/aVideoEncoder.json.php. Attackers can embed event-handler payloads in the URL host rendered as a Source tag in view/managerVideos_body.php, executing in administrator sessions to install plugin archives containing PHP.

CWE	CWE-79
Vendor	wwbn
Product	avideo
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for wwbn avideo

Be the first to know when new high vulnerabilities affecting wwbn avideo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

WWBN / AVideo

14.3 ≤ 29.7.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WWBN/AVideo/security/advisories/GHSA-2qq6-qfcq-jmr9 github.com: https://github.com/WWBN/AVideo/commit/da1da205608d57b1e695a7fad8288a2f5f9a0e0f github.com: https://github.com/WWBN/AVideo/blob/v29.7.1/objects/functionTags.php#L198-L221 github.com: https://github.com/WWBN/AVideo/blob/v29.7.1/view/managerVideos_body.php#L1997-L2011 vulncheck.com: https://www.vulncheck.com/advisories/wwbn-avideo-14.3-through-29.7.1-stored-xss-via-video-source-tag

Credits

AlpetGexha