A reflected Cross‑Site Scripting vulnerability exists in AVideo versions 25.0 and earlier. User input supplied through a URL parameter is encoded by PHP’s json_encode() and then embedded directly into JavaScript that renders the value via innerHTML, bypassing normal encoding. This allows an unauthenticated attacker to execute arbitrary JavaScript in a victim’s browser, potentially stealing session cookies, hijacking accounts, phishing credentials with injected forms, or propagating malicious payloads.

The affected product is WWBN AVideo, an open‑source video platform. All releases up to and including 25.0 are vulnerable, and the defect was fixed in version 26.0. No other vendors or products are listed as affected.

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by crafting a malicious URL; no privilege is required. Because the bug enables full script execution, the potential damage includes session theft, account takeover, and credential phishing, with significant confidentiality, integrity, and availability risks.