What is the CVSS score of CVE-2026-33683?

CVE-2026-33683 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Avideo are affected by CVE-2026-33683?

Organizations using versions should be aware of moderate risk from CVE-2026-33683, a cross-site scripting vulnerability rated CVSS 5.4.

How to fix or mitigate CVE-2026-33683?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Avideo CVE-2026-33683

EUVD-2026-14494 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-23 GitHub_M

GHSA-ghx5-7jjg-q2j7

XSS Avideo

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 19:00 euvd

EUVD-2026-14494

Analysis Generated

Mar 23, 2026 - 19:00 vuln.today

CVE Published

Mar 23, 2026 - 18:41 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, a sanitization order-of-operations flaw in the user profile "about" field allows any registered user to inject arbitrary JavaScript that executes when other users visit their channel page. The xss_esc() function entity-encodes input before strip_specific_tags() can match dangerous HTML tags, and html_entity_decode() on output reverses the encoding, restoring the raw malicious HTML. Commit 7cfdc380dae1e56bbb5de581470d9e9957445df0 contains a patch.

AnalysisAI

WWBN AVideo versions up to and including 26.0 contain a stored cross-site scripting (XSS) vulnerability in the user profile "about" field caused by improper sanitization order of operations. Any registered user can inject arbitrary JavaScript that executes when other users visit their channel page, allowing attackers to steal session cookies, perform actions on behalf of victims, or redirect users to malicious sites. A patch is available via commit 7cfdc380dae1e56bbb5de581470d9e9957445df0, and the vulnerability has been formally disclosed through GitHub Security Advisory GHSA-ghx5-7jjg-q2j7.

Technical ContextAI

The vulnerability exists in WWBN AVideo (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), an open-source video platform, and stems from a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) defect in the sanitization pipeline. The root cause is a critical order-of-operations flaw where the xss_esc() function entity-encodes HTML entities before strip_specific_tags() can identify and remove dangerous HTML tags. When output is rendered, html_entity_decode() reverses the entity encoding, restoring the raw malicious HTML and JavaScript that was never actually stripped. This chain of events creates a window for stored XSS attacks where attacker-controlled data persists in the database and executes in victim browsers without proper sanitization.

RemediationAI

Upgrade WWBN AVideo to a version that includes the patch from commit 7cfdc380dae1e56bbb5de581470d9e9957445df0 or any subsequent release containing this fix. Consult the vendor repository (https://github.com/WWBN/AVideo/commit/7cfdc380dae1e56bbb5de581470d9e9957445df0) for the exact patched version number. In the interim, if immediate upgrading is not possible, restrict the ability of untrusted users to edit their profile "about" field through role-based access controls, disable the profile feature entirely for non-administrative users, or implement a strict content security policy (CSP) header that blocks inline script execution. Additionally, audit existing user profiles for suspicious JavaScript or HTML content and consider clearing the "about" field for accounts that may have been compromised.