WWBN AVideo versions up to 29.0 contain a CWE-79 cross-site scripting vulnerability in the objects/notifySubscribers.json.php endpoint. The raw message POST parameter is passed directly into the sendSiteEmail() function, which inserts it into an HTML email template without any HTML sanitization, character escaping, or output encoding. This allows any authenticated user with upload permission to send arbitrary HTML content to all subscribers of their channel, potentially up to 10,000 recipients per invocation. The emails are sent from the platform's configured contact address and include official branding, making malicious content appear legitimate. A fix is referenced in a GitHub commit but no official patch or vendor advisory is provided in the input data.

An attacker with authenticated upload permissions can send crafted HTML emails to all subscribers of their channel, potentially delivering phishing links, tracking pixels, or UI spoofing content. Because the emails appear to come from the official platform address and branding, recipients may be more likely to trust and interact with the malicious content. This can lead to credential theft, privacy violations, or other social engineering impacts. There is no indication of direct system compromise or denial of service from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A GitHub commit containing a fix is referenced but no official patch or advisory is provided in this data. Until an official fix is applied, restrict upload permissions to trusted users only and monitor for suspicious email activity. Avoid relying solely on this platform's email communications for critical security notices. Follow up with the vendor for an official patch or update.