CVE-2026-84477: AVideo Stored XSS via Live Schedule Title Description

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-01 · updated 2026-09-08
Weakness: CWE-79

Description

AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.

Affected products

WWBN AVideo: through 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-625v-vrhq-g274
https://www.vulncheck.com/advisories/avideo-stored-xss-via-live-schedule-title-description
https://github.com/WWBN/AVideo/security/advisories/GHSA-625v-vrhq-g274

Get alerted when CVE-2026-84477 or the next vulnerability affects your stack