CVE-2026-100630: AVideo Stored XSS via HTML Entity Bypass in trailer1 Field
AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL() validation and are decoded by the browser to break out of the JavaScript string, executing arbitrary code in any visitor's session including administrators.
Affected Software
Event History
Frequently Asked Questions
Which users are able to introduce the malicious content?
An attacker needs video upload permission to store a payload in the trailer1 field.
Who is affected when the stored payload is viewed?
Any visitor whose session renders the affected trailer1 content can have arbitrary code executed in their browser, including administrators.
Does exploitation require interaction from a victim?
Yes. The vector specifies user interaction is required; the malicious trailer1 content must be rendered in the visitor's session.