CVE-2026-105089: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WWBN AVideo

WWBN AVideo versions up to and including 29.2.0 contain a stored XSS vulnerability where users with upload permission can inject malicious script code by setting a crafted video trailer URL. The vulnerability arises because this URL value is rendered unescaped in YouPHPFlix templates and channel playlists, enabling attackers to break out of HTML attributes such as onclick strings or iframe src attributes and execute arbitrary JavaScript in victim browsers.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of affected users' browsers, potentially leading to session hijacking, credential theft, or other malicious actions within the scope of the affected web application. The vulnerability requires the attacker to have upload permissions and user interaction (UI:P).

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and consider sanitizing or validating video trailer URLs before rendering.