WWBN AVideo is an open‑source video platform that, in versions 29.0 and earlier, contained a stored Cross‑Site Scripting flaw in the YouTubeAPI plugin. The plugin displays the video title field returned by the YouTube Data API directly in the homepage gallery without encoding it, treating the title as trusted content. A YouTube uploader can craft a title that includes JavaScript; if that video matches the platform’s search query, the malicious title is rendered on every page that shows the gallery. When an AVideo administrator views the gallery, the injected script runs with the administrator’s browser context. Because the platform uses cookie‑based authentication without additional CSRF protection for admin actions, the script can create users, promote them to administrator, alter configuration, or install plugins, effectively achieving full administrative takeover. The payload persists for the duration of the cache timeout (default 3600 seconds) after the video title is set, and it survives even if the hostile video is subsequently removed from YouTube.

The vulnerability impacts WWBN AVideo, version 29.0 and all older releases that include the unpatched YouTubeAPI plugin. Users running these versions are exposed to the stored XSS when the plugin processes foreign video titles.

The CVSS score of 4.7 indicates moderate severity, while the EPSS score of <1% suggests a very low likelihood of exploitation in the current environment. An attacker must set a malicious title that matches the platform’s query, wait for the cached title to be served, and have an administrator load a gallery page. When these conditions are met, the vulnerability escalates to administrative takeover via cookie‑based authentication. The issue is not listed in the CISA KEV catalog.