Technical impact
WWBN AVideo versions 26.0 through 29.3.0 contain a stored cross‑site scripting flaw that allows an attacker with comment posting privileges to inject JavaScript into pages viewed by other users. The vulnerability arises because the markdown renderer preserves event‑handler attributes in leading HTML blocks. An attacker can begin a comment with an <img> tag that carries an onerror handler, bypassing the inline sanitizer and causing the script to execute in the viewer's browser under the application origin. This can be used to hijack sessions, exfiltrate data, or deface the page. The weakness is classified as CWE‑79. Based on the description, it is inferred that the attacker must be an authenticated commenter because comment posting is required for the malicious payload to be stored.
Affected Systems
The flaw affects WWBN AVideo software versions 26.0 through 29.3.0. No newer release is listed in the data, but a patch commit is referenced, indicating that an updated version is planned or available.
Risk and Exploitability
The CVSS score of 5.1 places the flaw in a moderate severity range. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed. The likely attack vector is an authenticated user creating a comment, which is a low‑barrier action for anyone registered to comment. Because the exploit is stored, the malicious code remains until the comment is removed or the application is upgraded, so the risk is moderate but persists over time.
