Vulnerability · Published Oct 25, 2026 · Assigned by VulnCheck

CVE-2026-116139WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering

Medium 5.4

In plain English

A medium-severity cross-site scripting in AVideo from WWBN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 86.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML() preserves event-handler attributes in leading HTML blocks. Attackers can post a comment starting with an img tag carrying an onerror handler, which bypasses the inline sanitizer and executes in viewers' browsers under the application origin.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	26.0 – through 29.3.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-cx46-26xc-2w7f) vendor-advisory
Patch Commit patch
VulnCheck Advisory: WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering third-party-advisory