WWBN AVideo versions 29.0 and earlier contain a stored XSS vulnerability due to improper input validation in the isValidDuration() regex at objects/video.php:918. The regex lacks an end anchor, permitting attackers to append malicious HTML/JavaScript after a valid duration format. This malicious input is stored and later output without proper HTML escaping via echo Video::getCleanDuration() on multiple user-facing pages, enabling stored cross-site scripting attacks. The vulnerability is tracked as CWE-79. A code commit identified as bcba324644df8b4ed1f891462455f1cd26822a45 includes a fix for this issue.

Successful exploitation allows an attacker with limited privileges to inject and store malicious scripts that execute in the context of users viewing trending pages, playlists, or video gallery thumbnails. This can lead to information disclosure and integrity impacts, but does not affect availability. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impacts.

A fix for this vulnerability is available in the codebase as indicated by commit bcba324644df8b4ed1f891462455f1cd26822a45. Users of WWBN AVideo should update to a version including this fix to remediate the issue. Patch status is not explicitly confirmed in a vendor advisory; therefore, verify the presence of this commit or an official patch in the vendor's repository or release notes before deployment.