An improperly anchored regular expression used to validate video duration strings allows an attacker to prefix a valid timestamp, then append arbitrary HTML or JavaScript. When the crafted duration is stored in the database, it is later rendered without escaping on various pages such as trending videos, playlists, and thumbnail galleries, resulting in stored cross‑site scripting that is executed in the browsers of any site visitor.

WWBN AVideo versions 29.0 and earlier are affected because the regex at objects\/video.php:918 lacks a terminating anchor. The upstream patch (commit bcba324644df8b4ed1f891462455f1cd26822a45) updates the pattern to include a $ anchor. Administrators who allow users to submit or edit video metadata must be aware that any user capable of providing a duration field could trigger this issue.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to insert or modify a video's duration, which is typically available to account holders who can upload or edit content. Once stored, the malicious payload is served to all visitors who load pages that display the duration, potentially enabling arbitrary script execution in those browsers.