The vulnerability resides in the YPTWallet Stripe payment confirmation page, which echoes the 'plugin' request parameter without sanitization. Because this parameter is not filtered by the framework, an attacker can inject arbitrary JavaScript into the page. The injected script runs in the victim's browser and can read the rendered username and password hash from the page. Thus the attacker can steal credentials and potentially use them for further attacks.

The affected product is WWBN AVideo. Versions up to and including 26.0 are vulnerable. The issue was fixed in a later commit.

This flaw has a CVSS score of 8.2, indicating a high severity. The exploit is remote and requires an attacker to send a malicious URL that includes a crafted 'plugin' parameter to a victim user. No exploit probability score is available and the vulnerability is not listed in the CISA KEV catalog. An attacker who succeeds can exfiltrate credentials and cause significant damage.