Avideo EUVD-2026-14494

While the CVSS v3.1 score of 5.4 (Medium) appears moderate, the attack vector is network-based with low complexity and only requires low privileges (any registered user), making exploitation highly feasible. The stored nature of this XSS—persisting in user profile data—makes it particularly dangerous compared to reflected variants, as all visitors to a compromised channel are automatically exposed. The vulnerability affects the confidentiality and integrity (C:L/I:L) of user sessions but not availability. The cross-site scope flag (S:C) indicates potential impact beyond the vulnerable application itself. Real-world risk is elevated due to the trivial exploitation requirements (no special tools needed, just profile editing) and the fact that legitimate users are likely to visit channel pages containing malicious content. The availability of a specific commit patch reduces remediation burden but does not lower current risk for unpatched instances.

An attacker with any valid account on a WWBN AVideo instance crafts malicious JavaScript and inserts it into their profile "about" field, bypassing the broken sanitization order. When a legitimate user visits the attacker's channel page to view videos or profile information, the stored JavaScript automatically executes in the victim's browser with the victim's privileges, allowing the attacker to steal the victim's session token, change account settings, or redirect the user to a phishing site. This scenario requires no special tools and exploits the trust users place in viewing channel pages.