WWBN AVideo, an open source video platform, stores the content of a category description directly from user input and later renders it as raw HTML in the gallery view. This allows a user with permission to create or edit categories to inject and persist JavaScript code that executes in the browsers of any user who visits the affected gallery page, providing a stored cross‑site scripting vector that could compromise user accounts or deliver malware.

AVideo versions 29.0 and older are affected. The vulnerable product is WWBN AVideo, and any installation running these versions without the patch can be impacted when users have rights to create or edit gallery categories.

The CVSS score is 5.4, indicating a medium impact. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is application‑based; an attacker must be an authenticated user with category‑management privileges to insert malicious code into the description. Once the payload is stored, it is presented unchanged to all users who view the gallery page, giving the attacker an opportunity to execute arbitrary client‑side code, potentially exfiltrating data or hijacking sessions.