WWBN AVideo suffers from a stored cross‑site scripting flaw in the user profile "about" field. The framework applies entity encoding before removing dangerous tags, then decodes the content when rendering the channel page. This ordering allows an attacker to inject arbitrary JavaScript that executes in the browsers of all visitors to the malicious profile. The attack can be used to steal session cookies, deface content, or redirect users to phishing sites.

The vulnerability affects the open source AVideo platform distributed by WWBN. All installations running version 26.0 or earlier are impacted. Versions 26.1 and later include a patch that corrects the sanitization order.

With a CVSS score of 5.4 the vulnerability is considered medium‑severity; the EPSS indicates a very low overall exploit probability (<1%), and it is not listed in the CISA KEV catalog. Exploitation requires only a valid registered account to submit the malicious "about" text, and any other user who visits the channel becomes a victim. Because the payload runs in the victim’s browser, the attack is client‑side but achieves high impact on confidentiality and integrity of the victim’s session. The vulnerability is easily exploitable once the patch is not applied.