WWBN AVideo's Electronic Program Guide (EPG) feature in versions 26.0 and prior improperly neutralizes input during web page generation. Specifically, it parses XML from user-controlled URLs and renders the <title> elements directly into HTML without escaping or sanitization. This allows an attacker with upload permissions to craft a malicious XML file whose <title> contains JavaScript code. When an unauthenticated user visits the public EPG page, the malicious script executes in their browser, enabling cross-site scripting attacks that can lead to session hijacking and account takeover. The vulnerability is tracked as CVE-2026-39367 with a CVSS 3.1 base score of 5.4 (medium severity). No official patch or remediation guidance is currently available.

Successful exploitation allows an attacker with upload permissions to execute arbitrary JavaScript in the browsers of unauthenticated visitors to the public EPG page. This can lead to session hijacking and account takeover. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS score of 5.4 reflects a medium severity level with network attack vector, low attack complexity, and required privileges of upload permission with user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and consider disabling or restricting access to the EPG feature if possible. Monitor for updates from WWBN regarding an official fix or mitigation.