5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47694

CVE-2026-47694: WWBN AVideo: Stored XSS via unescaped Gallery category description

WWBN AVideo is an open source video platform. In 29.0 and earlier, AVideo stores category descriptions from user input and later renders category_description as raw HTML in the Gallery view. A user who can create or edit categories can store JavaScript in a category description, which executes when another user views the affected Gallery/category page. This is a stored XSS in the category description field, separate from previously fixed XSS issues in video titles or comments.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47694

CVE-2026-47694:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
WWBN/AVideo	composer	<= 29.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) in the category description of WWBN AVideo. The analysis of the provided vulnerability description and the associated commit 6a6ff1f5bff1904f91f612db9f0da083295392b1 reveals the complete lifecycle of the vulnerability.

The vulnerability originates in objects/category.php within the Category.setDescription method. This method is called from objects/categoryAddNew.json.php and directly takes user input from $_POST['description'] and assigns it to a category object's property without any form of sanitization or validation. This allows malicious script content to be stored in the database.

The stored payload is then rendered on the gallery page, triggering the XSS. The sink is located in plugin/Gallery/view/mainAreaCategory.php inside the createCategorySection function. Before the patch, this function would echo the category_description directly to the page, causing the browser to execute any embedded scripts. The patch mitigates this by applying htmlentities() to the description before rendering it, thus neutralizing the script content.

Both Category.setDescription (the source) and createCategorySection (the sink) are critical functions in the exploit chain and would appear in runtime profiles during the attack.

Vulnerable functions

createCategorySection

plugin/Gallery/view/mainAreaCategory.php

The function `createCategorySection` is vulnerable to stored XSS as it renders the `category_description` without proper escaping. The patch applies `htmlentities` to mitigate this.

Category.setDescription

objects/category.php

The `setDescription` method on the `Category` object is the entry point for the tainted data. It directly assigns the user-provided `description` to the object's property without any sanitization, which is then persisted.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.