Is CVE-2026-47694 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47694 being exploited in the wild.

How severe is CVE-2026-47694?

Medium severity, with a CVSS score of 5.4, published 29 May 2026.

Which products and versions are affected?

wwbn/avideo (Packagist) <= 29.0, ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0, 29.0 and earlier.

Is there a fix for CVE-2026-47694?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47694 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47694?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47694: WWBN AVideo stored XSS in category description

Q: Is there a fix for CVE-2026-47694?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-47694 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-47694?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47694 · Severity: medium · CVSS 5.4 · Published 2026-05-29

WWBN AVideo, a video sharing and streaming platform, is vulnerable to a security flaw where malicious code can be hidden in category descriptions. An attacker with permissions to manage categories can inject scripts that execute in the browsers of other users or administrators who view the gallery. This could lead to unauthorized actions being performed on behalf of users, data theft, or the compromise of administrative accounts.

Technologies: wwbn/avideo (Packagist), WWBN AVideo. Vendors: Packagist, WWBN.

Quick answers

Is CVE-2026-47694 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47694 being exploited in the wild.
How severe is CVE-2026-47694?: Medium severity, with a CVSS score of 5.4, published 29 May 2026.
Which products and versions are affected?: wwbn/avideo (Packagist) <= 29.0, ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0, 29.0 and earlier.
Is there a fix for CVE-2026-47694?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47694 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47694?: Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in WWBN AVideo versions up to 29.0. The root cause is the lack of output encoding or sanitization of the 'category_description' field in the Gallery plugin's 'mainAreaCategory.php' view. An attacker with category creation or editing privileges can inject a malicious JavaScript payload into the description field via 'objects/categoryAddNew.json.php'. When a victim (user or administrator) views the affected Gallery or category page, the payload executes in their browser context. This can be used to hijack sessions, steal sensitive information, or perform unauthorized administrative actions. A fix involving 'htmlspecialchars()' or 'HTMLPurifier' is recommended.

Affected products

WWBN AVideo <= 29.0

Identifiers

CVE-2026-47694
GHSA-c8h8-vq34-9fw2

Timeline

2026-05-19: disclosed: Initial disclosure on GitHub
2026-05-29: advisory: NVD publication date
2026-06-04: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.