A custom sanitization class was added to WWBN AVideo to filter raw HTML tags in comments, but the class disables Parsedown’s safe mode. This turns off the built‑in ‘javascript:’ URI filter, allowing a markdown link such as [text](javascript:alert(1)) to be processed and stored unchanged. When a user views the comment, the browser executes the injected script, giving the attacker the ability to run arbitrary code in the victim’s session. The vulnerability is a classic stored XSS (CWE‑79) that can lead to session hijacking, defacement, or theft of sensitive data.

WWBN AVideo, all releases up to and including version 26.0, are affected. The issue resides in the comment handling subsystem and impacts every instance that uses the default comment moderation in those releases.

The CVSS score of 5.4 indicates a moderate severity, while an EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog, so no known exploits exist yet. The likely attack vector is through social or spam comment posting; an attacker only needs the ability to add a comment to a publicly visible page. Once the malicious markdown link is stored, any subsequent viewer of the page will be exposed to the injected script, making the damage immediate for each visitor.