An unauthenticated attacker can embed malicious JavaScript into the YPTWallet Stripe payment confirmation page by supplying a specially crafted `plugin` value in the URL; because the application writes the value directly into a JavaScript block without any encoding, the code runs in the victim’s browser. In addition, the page outputs the logged‑in user’s name and password hash, so a successful exploit can exfiltrate those credentials instantly.

The flaw exists in the WWBN AVideo video platform, affecting all releases up to and including version 26.0; it is triggered on the YPTWallet Stripe payment confirmation page where the `plugin` query parameter is not sanitized.

The CVSS v3 score of 8.2 classifies this as High severity. The EPSS score is below 1 %, indicating that widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, a reflected XSS that can read the user’s password hash presents a serious risk to confidentiality and could lead to credential theft. The attack can be performed by directing a victim to a crafted URL; no privileged access is required, making it a low‑barrier exploit.