The vulnerability in WWBN AVideo arises from improper neutralization of input during web page generation. Specifically, the POST parameters 'name' and 'iconClass' are passed to Category::setName() and Category::setIconClass() without proper sanitization. The category name is truncated to 45 characters but not sanitized, and both values are later echoed directly into HTML contexts (text and class attributes) in various views. When the usersCanCreateNewCategories option is enabled, any authenticated user with canUpload permission can create categories containing malicious JavaScript payloads. These payloads execute in the browsers of users viewing affected video pages or gallery entries, enabling actions such as authenticated requests with the victim's session. The vulnerability is unpatched as of the report date.

An attacker with authenticated upload permissions can inject persistent JavaScript payloads that execute in the browsers of any users, including administrators, who view videos assigned to the malicious category. This can lead to session hijacking and unauthorized actions performed with the victim's privileges. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical impact with network attack vector, low attack complexity, and no privileges required beyond upload permission.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the usersCanCreateNewCategories option or restricting upload permissions to trusted users only to mitigate exploitation risk.