Vulnerability · Published Sep 26, 2026 · Assigned by VulnCheck

CVE-2026-100630AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field

Medium 5.4

In plain English

A medium-severity cross-site scripting in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 79.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL() validation and are decoded by the browser to break out of the JavaScript string, executing arbitrary code in any visitor's session including administrators.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	0 – before 29.1.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-v7vx-v9q9-qhw3) vendor-advisory
https://github.com/WWBN/AVideo/commit/40b3267760924389c626a549bb1c6fd013b3b29c patch
VulnCheck Advisory: AVideo Stored XSS via HTML Entity Bypass in trailer1 Field third-party-advisory