CVE-2026-89243
WWBN AVideo contains a stored cross‑site scripting flaw that lets administrators inject malicious HTML or JavaScript into the user manager interface. The vulnerability is triggered when an admin with the canAdminUserGroups permission sets a group name that includes unfiltered script. It can be exploited by anyone who can create or edit user groups.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WWBN AVideo (all versions that include the setGroup_name() function). The flaw affects administrators who have the canAdminUserGroups permission.
Real-world impact
An attacker who can edit a group name can inject code that runs in the browsers of other administrators when they view the user manager page. This could allow the attacker to steal session cookies, deface the interface, or perform other malicious actions within the admin session.
Why this severity
The CVSS score of 9.2 reflects a high likelihood of exploitation (low attack complexity, no user interaction required) combined with a high impact: the vulnerability allows attackers to execute arbitrary code in the context of privileged administrators, leading to potential full compromise of the application.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources