WWBN AVideo, versions 29.0 and below, contains a stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json['msg'], but msgToResourceId() reads from $msg['json'] with a higher priority, allowing an attacker to inject malicious JavaScript into the json key and bypass sanitization. An attacker can place the XSS payload in the json key instead of msg, bypassing the sanitization entirely. An authenticated attacker can execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system, stealing session cookies and authentication tokens, taking over accounts through session hijacking, and chaining with CSRF to perform admin actions on the victim's behalf, in the default SQLite WebSocket backend configuration. A patch exists in a recent commit but has not yet been officially released.

The impacted product is the open‑source video platform AVideo from WWBN. Versions 29.0 and below are affected, especially those using the default SQLite WebSocket backend configuration.

The vulnerability has a CVSS score of 7.7, indicating medium‑to‑high severity, while its EPSS score is below 1%, suggesting a low current exploitation probability. It is not listed in CISA’s KEV catalog. The flaw requires an authenticated user to send a crafted WebSocket message; once exploited, it grants an attacker the ability to execute JavaScript in the victim’s browser, compromising confidentiality, integrity, and availability by hijacking sessions and enabling further privileged actions.