The Electronic Program Guide (EPG) of WWBN AVideo imports XML from a user‑supplied URL and injects title elements directly into the browser page without sanitization or escaping. When a user with upload permission assigns a video the epg_link field to a malicious XML file containing JavaScript in its <title> tags, that script runs in any browser that loads the public EPG page. The injected code can steal session cookies and take over user accounts, representing a classic stored cross‑site scripting flaw. The weakness corresponds to OWASP's CWE‑79.

All releases of WWBN AVideo version 26.0 and earlier are affected. Users who run these or older versions without the addressed patch are exposed until upgrading to a newer release that sanitizes EPG titles.

The CVSS score of 5.4 places the flaw in a moderate severity range. No EPSS value or KEV listing is available, but the vulnerability requires only an authenticated upload‑capable user to supply the malicious XML. Once the XML is stored, every unauthenticated visitor to the EPG page becomes a victim, making the attack vector publicly reachable via web browsers. Though server compromise is not required, the potential for widespread account takeover warrants prompt remediation.