CVE-2026-126810: WWBN AVideo 29.1.0 through 29.7.1 Stored XSS via Channel RSS Feed
WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed.
Event History
Frequently Asked Questions
Who can exploit this issue and who is at risk when it is triggered?
A registered user can inject the malicious markup through a channel's About field. Any visitor who views the affected channel feed can trigger the payload, including administrators.
What conditions are required for exploitation?
The attacker needs a registered account and must be able to set a channel About field. Exploitation also requires a victim to view the channel feed, where the content is rendered through rss-style.xsl.
Which versions are affected?
WWBN AVideo versions 29.1.0 through 29.7.1 are affected.