CVE-2026-126810

MEDIUM 5.4

WWBN AVideo 29.1.0 through 29.7.1 Stored XSS via Channel RSS Feed

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed.

CWE	CWE-79
Vendor	wwbn
Product	avideo
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for wwbn avideo

Be the first to know when new medium vulnerabilities affecting wwbn avideo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

WWBN / AVideo

29.1.0 ≤ 29.7.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WWBN/AVideo/security/advisories/GHSA-2qxw-wm6h-5jr7 github.com: https://github.com/WWBN/AVideo/commit/069557e55f804346bf6ef4c0a5f1b44bfe1a0d9f github.com: https://github.com/WWBN/AVideo/blob/v29.7.1/feed/index.php#L143-L169 github.com: https://github.com/WWBN/AVideo/blob/v29.7.1/feed/rss-style.xsl#L32-L41 vulncheck.com: https://www.vulncheck.com/advisories/wwbn-avideo-29.1.0-through-29.7.1-stored-xss-via-channel-rss-feed

Credits

AlpetGexha