CVE-2026-47694 Details
Description
WWBN AVideo is an open source video platform. In 29.0 and earlier, AVideo stores category descriptions from user input and later renders category_description as raw HTML in the Gallery view. A user who can create or edit categories can store JavaScript in a category description, which executes when another user views the affected Gallery/category page. This is a stored XSS in the category description field, separate from previously fixed XSS issues in video titles or comments.
A stored cross-site scripting vulnerability has been identified in WWBN AVideo versions through 29.0. The issue arises because category descriptions are saved from user input and later displayed as raw HTML in the Gallery view. Users with the ability to create or edit categories can inject JavaScript into the category description, which is executed when another user views the corresponding Gallery or category page. This vulnerability is distinct from previously addressed XSS issues in video titles or comments.
Category descriptions should be sanitized on input using the same HTML policy applied to video descriptions, or stored as plain text. When outputting category descriptions, they should be encoded to prevent execution of injected scripts. If limited HTML is allowed, use a library like HTMLPurifier to clean the input before storage or rendering. Additionally, regression tests should be implemented to ensure category descriptions are properly handled in Gallery views.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-c8h8-vq34-9fw2 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-c8h8-vq34-9fw2 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 29.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 30, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | New CVE Received | [email protected] |