The vulnerability in WWBN AVideo (commit c3edcc274c389816d434acadac07ee78eaf330c1) is a stored cross-site scripting issue in the Bookmark plugin. Chapter names are concatenated into the public watch-page HTML without proper encoding, enabling a video owner to inject malicious JavaScript code through the bookmark name parameter. When other users visit the affected video page, the injected script executes in their browsers within the AVideo origin context.

Successful exploitation allows an attacker who controls a video to execute arbitrary scripts in the browsers of visitors to that video page. This can lead to session hijacking, defacement, or other malicious actions within the context of the affected site. The CVSS 4.0 score of 9.3 reflects high impact with network attack vector, low attack complexity, no privileges required beyond video ownership, and high impact on confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about videos from untrusted sources and consider disabling or restricting the Bookmark plugin if possible.