CVE-2026-47694 is a stored cross-site scripting vulnerability in WWBN AVideo (versions 29.0 and earlier). The issue arises from improper neutralization of user input in the category description field, which is rendered as raw HTML in the Gallery view. An attacker with privileges to create or edit categories can inject malicious JavaScript that executes in the browsers of users who view the affected category page. This vulnerability is separate from earlier XSS vulnerabilities fixed in other parts of the application such as video titles or comments.

Successful exploitation allows an attacker with category creation or editing privileges to execute arbitrary JavaScript in the context of other users viewing the Gallery/category page. This can lead to information disclosure or session hijacking limited to users who visit the affected page. The vulnerability does not impact availability and requires user interaction (viewing the page).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict category creation and editing permissions to trusted users only to reduce risk. Monitor vendor communications for updates regarding an official fix.