CVE-2026-84477: Wwbn Avideo

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication.

Affected products

• Wwbn Avideo: up to and including 29.0

Published 2026-09-01. Last modified 2026-09-08.