WWBN AVideo contains a stored cross‑site scripting vulnerability in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1. The flaw arises when the category creation API passes the submitted name and iconClass fields to Category::setName() and Category::setIconClass() without sanitization; setName merely truncates the input to 45 characters. These unfiltered values are later rendered as raw HTML text for the category name and as a class attribute in gallery and video pages. An attacker can embed a JavaScript payload in either field, resulting in client‑side code execution when the affected page is viewed.

Systems running WWBN AVideo older than the commit identified above are impacted. All releases built before the upstream change that corrected the input handling are vulnerable. Administrators, developers, and any users with the canUpload permission – which is granted by default during self‑registration – can create malicious categories.

The CVSS base score of 9.3 signals a critical severity, and the vulnerability is exploitable from within an authenticated session. Because the payload materializes in the browser of any visitor, including privileged users, the attack can lead to information disclosure, session hijacking, or further compromise of the host. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog, but the lack of mitigation and the high impact of the flaw still demand urgent remediation.