WWBN AVideo contains a stored XSS flaw that allows an attacker who can create or modify a video to inject arbitrary JavaScript through the unescaped clean_title field. The injected script is embedded directly into a JavaScript string literal in CDN downloadButtons.php, causing it to run automatically whenever any user accesses the affected download page. The attacker could use the script to steal information from the victim’s browser or hijack the user’s session; these possibilities are inferred from the nature of stored XSS.

Any deployment of WWBN AVideo using the CDN plugin’s downloadButtons.php with a version earlier than 26.0 is vulnerable. The vulnerability applies to all installations of the open‑source video platform that have not yet applied the patch fixed in release 26.0.

The CVSS score of 8.2 classifies the flaw as high severity. EPSS is reported as less than 1 %, indicating a low forecasted probability of exploitation, but the presence of stored XSS and lack of a KEV listing do not diminish the potential impact. The likely attack vector is web‑based, requiring the attacker to create or modify a video record through the platform’s interface or API; once the payload is stored, it executes automatically for all visitors to the affected download page.