Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-39367WWBN AVideo has Stored XSS via Malicious EPG XML Program Titles in AVideo EPG Page

Medium 5.4

In plain English

A medium-severity cross-site scripting in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 89.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's EPG (Electronic Program Guide) feature parses XML from user-controlled URLs and renders programme titles directly into HTML without any sanitization or escaping. A user with upload permission can set a video's epg_link to a malicious XML file whose <title> elements contain JavaScript. This payload executes in the browser of any unauthenticated visitor to the public EPG page, enabling session hijacking and account takeover.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	wwbn/avideo	no fix listed	GHSA-rqp3-gf5h-mrqx

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	<= 26.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-rqp3-gf5h-mrqx x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/e0212add4aad0f1e97758a4b4fdc57df58ce68e8 x_refsource_MISC