WWBN AVideo CVE-2026-88867

Requires the CustomizeUser option usersCanCreateNewCategories to be enabled AND an authenticated account with canUpload permission - obtainable by default through self-registration. Exploitation also depends on a victim (ideally an administrator) subsequently viewing a watch page or Gallery entry for a video assigned to the attacker-created category (the UI:P/user-interaction requirement). It does not work if category self-creation is disabled, if self-registration/canUpload is restricted, or if no privileged user views affected content; the category name field is additionally limited to 45 characters by setName() truncation, constraining the inline payload length.

The vendor-supplied CVSS 4.0 vector (9.3, AV:N/AC:L/PR:L/UI:P/VC:H/VI:H/SC:H/SI:H) matches the described mechanics: network-reachable, low attacker privilege, and passive victim interaction (viewing a page), with a security-context change into the victim's session that plausibly reaches an administrator. Real-world risk is meaningfully gated by two prerequisites the description states explicitly - the CustomizeUser option usersCanCreateNewCategories must be enabled, and an attacker needs a canUpload account (obtainable by default via self-registration). No EPSS score, KEV listing, or public PoC is present in the provided data, so this is a credible high-severity stored XSS but not evidence of active or automated exploitation; treat the high score as impact-driven potential rather than confirmed widespread exploitation. The stored/persistent nature and admin-session reachability justify prioritizing it on internet-facing instances where category self-creation is enabled.

An attacker self-registers on a public AVideo instance that has usersCanCreateNewCategories enabled, obtaining a canUpload account, then creates a category whose name or iconClass contains a JavaScript payload. When an administrator later opens a watch page or gallery entry for any video assigned to that category, the stored script runs in the admin's authenticated session and issues privileged requests (e.g., creating an admin user or changing settings). No public exploit code is identified at time of analysis, but the attack requires no special tooling beyond a browser.