AVideo, an open‑source video platform, allows Markdown in video comments and previously used Parsedown v1.7.4 without Safe Mode enabled. Markdown links were not properly sanitized, permitting `javascript:` URIs to be rendered as clickable links. An authenticated low‑privilege attacker can post a malicious comment that injects persistent JavaScript. When another user clicks the link, the attacker can hijack the session, gain administrative privileges, and exfiltrate data.

The vulnerability affects all installations of WWBN AVideo prior to version 21.0. Any instance running a version earlier than this upgrade that permits Markdown comments is vulnerable.

The flaw has a CVSS score of 5.1, indicating medium severity. The EPSS is reported as < 1 %, implying that exploitation is considered unlikely but not impossible. The issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with low privileges to post a comment containing a malicious link, after which an unsuspecting user must click the link to trigger the stored XSS payload.