{"id":"CVE-2026-126810","kind":"vulnerability","aliases":["CVE-2026-126810"],"related":[],"title":"WWBN AVideo: stored XSS in channel About field runs script for visitors","description":"WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed.","summary":"Registered AVideo users can store a crafted About field on their channel that bypasses the feed's HTML filter. The script runs in the browser of any visitor who views the channel feed, including administrators.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avideo","package","php","self-hosted"],"not_affected_if":["no-public-registration","other-versions"],"how_to_check":"- Confirm the installed AVideo version with the project's version file; versions `29.1.0` through `29.7.1` are listed as affected.\n- Check whether `feed/index.php` renders channel About text through `feedHtmlDescription()` and `rss-style.xsl`.","fix":"- Move to a version later than `29.7.1` (the sources do not name the exact fixed release).","status":"open","published_at":"2026-11-11T21:16:45+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","triaged_at":"2026-11-11T21:30:53+00:00","updated_at":"2026-11-11T21:30:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T21:30:53Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a version later than `29.7.1` (the sources do not name the exact fixed release).","reach":"internet","title":"WWBN AVideo: stored XSS in channel About field runs script for visitors","impact":"medium","summary":"Registered AVideo users can store a crafted About field on their channel that bypasses the feed's HTML filter. The script runs in the browser of any visitor who views the channel feed, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["avideo","self-hosted","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Script runs in admin browsers, enabling session theft or account actions.","analyst_note":"Confirm the fixed version and whether default configuration is affected via the vendor advisory and patch links.","how_to_check":"- Confirm the installed AVideo version with the project's version file; versions `29.1.0` through `29.7.1` are listed as affected.\n- Check whether `feed/index.php` renders channel About text through `feedHtmlDescription()` and `rss-style.xsl`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-public-registration","other-versions"],"who_is_affected":"Sites running AVideo versions 29.1.0 through 29.7.1 that let registered users create channels. Exposure depends on the feed page rendering the About field; sites with no registration or with the feed disabled are less exposed. The sources do not say whether a default configuration is vulnerable.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000754,"input_tokens":4650,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126810':15A,18A '-2026':14A,17A '29.1.0':62C '29.7.1':64C 'administr':59B,109C 'allow':74C 'attack':88C 'avideo':2A,19B,26B,61C 'browser':49B 'bypass':38B,98C 'channel':6A,36B,56B,82C,112C 'contain':65C 'craft':31B 'cross':69C 'cross-sit':68C 'cve':13A,16A 'event':94C 'event-handl':93C 'execut':102C 'feed':40B,57B,113C 'feed/index.php':87C 'feedhtmldescript':99C 'field':8A,33B,84C 'filter':43B,100C 'handler':95C 'host':24B 'html':42B 'includ':58B,108C 'inject':78C 'markup':79C 'packag':20B 'payload':96C 'php':21B 'regist':25B,75C 'render':85C 'rss-style.xsl':104C 'run':9A,46B 'script':10A,45B,71C 'self':23B 'self-host':22B 'site':70C 'store':3A,29B,67C,90C 'unquot':92C 'user':27B,76C 'via':103C 'view':54B,110C 'visitor':12A,52B,107C 'vulner':72C 'wwbn':1A,60C 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Sites running AVideo versions 29.1.0 through 29.7.1 that let registered users create channels. Exposure depends on the feed page rendering the About field; sites with no registration or with the feed disabled are less exposed. The sources do not say whether a default configuration is vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["avideo","medium","package","php","selfhosted"],"campaign_type":null,"search_a":"'-126810':15A,18A '-2026':14A,17A 'avideo':2A 'channel':6A 'cve':13A,16A 'field':8A 'run':9A 'script':10A 'store':3A 'visitor':12A 'wwbn':1A 'xss':4A","search_b":"'administr':59B 'avideo':19B,26B 'browser':49B 'bypass':38B 'channel':36B,56B 'craft':31B 'feed':40B,57B 'field':33B 'filter':43B 'host':24B 'html':42B 'includ':58B 'packag':20B 'php':21B 'regist':25B 'run':46B 'script':45B 'self':23B 'self-host':22B 'store':29B 'user':27B 'view':54B 'visitor':52B","search_c":"'29.1.0':62C '29.7.1':64C 'administr':109C 'allow':74C 'attack':88C 'avideo':61C 'bypass':98C 'channel':82C,112C 'contain':65C 'cross':69C 'cross-sit':68C 'event':94C 'event-handl':93C 'execut':102C 'feed':113C 'feed/index.php':87C 'feedhtmldescript':99C 'field':84C 'filter':100C 'handler':95C 'includ':108C 'inject':78C 'markup':79C 'payload':96C 'regist':75C 'render':85C 'rss-style.xsl':104C 'script':71C 'site':70C 'store':67C,90C 'unquot':92C 'user':76C 'via':103C 'view':110C 'visitor':107C 'vulner':72C 'wwbn':60C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T16:10:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126810","severity":null,"published_at":"2026-11-11T21:16:45+00:00","modified_at":"2026-11-11T21:16:45+00:00","first_seen_at":"2026-11-11T21:29:08+00:00","fetched_at":"2026-11-11T21:29:08+00:00","note":null}],"documents":[{"id":128986,"url":"https://github.com/WWBN/AVideo/commit/069557e55f804346bf6ef4c0a5f1b44bfe1a0d9f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128987,"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qxw-wm6h-5jr7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-11T16:10:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":128988,"url":"https://www.vulncheck.com/advisories/wwbn-avideo-29.1.0-through-29.7.1-stored-xss-via-channel-rss-feed","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}