CVE-2026-47694 is a stored cross-site scripting vulnerability in WWBN AVideo (<= 29.0) caused by improper neutralization of user input in the category description field. The application stores category descriptions as raw HTML and renders them in the Gallery view, allowing users with category creation or edit privileges to inject malicious JavaScript. This script executes in the context of other users viewing the category page, potentially leading to information disclosure or session hijacking. This vulnerability is separate from previously addressed XSS flaws in other parts of the application.

Successful exploitation allows an attacker with category creation or editing rights to inject and execute arbitrary JavaScript in the browsers of users who view the affected category pages. This can lead to limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. There is no direct availability impact. The vulnerability requires some user interaction (viewing the category page) and privileges to create or edit categories.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict category creation and editing permissions to trusted users only to reduce risk. Monitor vendor channels for updates and apply official patches once released.