CVE-2026-85158: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WWBN AVideo

The vulnerability in WWBN AVideo (CVE-2026-85158) is a reflected cross-site scripting issue in the videoEmbeded.php file. Specifically, the link parameter is included inside an HTML comment without escaping, enabling attackers to terminate the comment and inject malicious JavaScript code. This code executes in the context of the victim's browser when they access a specially crafted embed URL. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, low confidentiality and integrity impact, and no availability impact.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session when visiting a maliciously crafted embed URL. This can lead to actions such as session hijacking, defacement, or other client-side attacks depending on the injected script. The impact is limited to the confidentiality and integrity of the client-side environment with no direct impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on untrusted embed URLs. Implementing input validation and proper escaping of parameters in HTML comments is recommended once a fix is released.