CVE-2026-116139: WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering

Q: Who can exploit this issue, and who is exposed to the payload?

An authenticated user who can post comments can inject the payload. Any user who views the malicious comment may execute the attacker-supplied JavaScript in their browser under the AVideo application origin.

Q: Does exploitation require a complex payload or special interaction?

The described exploit uses a comment beginning with an img HTML tag containing an onerror event handler. Exploitation has low attack complexity, but a viewer must load the comment for the JavaScript to execute.

Q: Which versions are affected?

WWBN AVideo versions 26.0 through 29.3.0 are identified as affected.

Published Oct 25, 2026

Updated

WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML() preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerror handler, which bypasses the inline sanitizer and executes in viewers' browsers under the application origin.

Affected Software

1 affected component

WWBN AVideo>=26.0<=29.3.0

Event History

Oct 25, 2026

CVE Published

via MITRE·01:19 PM

Data Sourced

via MITRE·01:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

An authenticated user who can post comments can inject the payload. Any user who views the malicious comment may execute the attacker-supplied JavaScript in their browser under the AVideo application origin.

Does exploitation require a complex payload or special interaction?

The described exploit uses a comment beginning with an img HTML tag containing an onerror event handler. Exploitation has low attack complexity, but a viewer must load the comment for the JavaScript to execute.

Which versions are affected?

WWBN AVideo versions 26.0 through 29.3.0 are identified as affected.

CVE-2026-116139: WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

Does exploitation require a complex payload or special interaction?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is exposed to the payload?

Does exploitation require a complex payload or special interaction?

Which versions are affected?