{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"WWBN/AVideo","product":"AVideo","source":"CNA: VulnCheck","vendor":"WWBN","versions":[{"lessThanOrEqual":"29.7.1","status":"affected","version":"29.1.0","versionType":"semver"}]}],"cveId":"CVE-2026-126810","cwes":["CWE-79"],"description":"WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription() filtering and executes via rss-style.xsl for any visitor, including administrators, viewing the channel feed.","epss":{"date":"2026-11-13","percentile":0.15219,"score":0.0024},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qxw-wm6h-5jr7"}],"kev":null,"metrics":[{"score":5.1,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0"},{"score":5.4,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},{"score":5.1,"severity":"medium","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"},{"score":5.4,"severity":"medium","source":"NVD: disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794592174254,"publishedAt":1794430391690,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qxw-wm6h-5jr7"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/WWBN/AVideo/commit/069557e55f804346bf6ef4c0a5f1b44bfe1a0d9f"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/WWBN/AVideo/blob/v29.7.1/feed/index.php#L143-L169"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/WWBN/AVideo/blob/v29.7.1/feed/rss-style.xsl#L32-L41"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/wwbn-avideo-29.1.0-through-29.7.1-stored-xss-via-channel-rss-feed"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qxw-wm6h-5jr7"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/WWBN/AVideo/blob/v29.7.1/feed/index.php#L143-L169"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/WWBN/AVideo/blob/v29.7.1/feed/rss-style.xsl#L32-L41"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/WWBN/AVideo/commit/069557e55f804346bf6ef4c0a5f1b44bfe1a0d9f"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-2qxw-wm6h-5jr7"},{"source":"disclosure@vulncheck.com","tags":[],"url":"https://www.vulncheck.com/advisories/wwbn-avideo-29.1.0-through-29.7.1-stored-xss-via-channel-rss-feed"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/WWBN/AVideo/commit/069557e55f804346bf6ef4c0a5f1b44bfe1a0d9f"}],"revision":"2f43d77f27d114ca3963b32a6e72986ed461f03347710d09f0d3890b23de2142","sources":[{"modifiedAt":1794592174254,"name":"CNA: VulnCheck","retrievedAt":1794593366972,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126810"},{"modifiedAt":1794431805460,"name":"NVD","retrievedAt":1794443546998,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126810"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794593395468,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-126810"}],"ssvc":{"assessedAt":1794592143555,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"WWBN AVideo 29.1.0 through 29.7.1 Stored XSS via Channel RSS Feed","updatedAt":1794593395468}