The vulnerability is a stored XSS flaw in the AVideo admin panel. Plugin configuration values are rendered directly into HTML without encoding. An attacker who can set a plugin configuration value—either by gaining administrator privileges or by chaining a CSRF attack on the admin/save.json.php endpoint—can inject arbitrary JavaScript. When any administrator loads the plugin configuration page, the malicious script runs in the admin’s browser context, potentially leading to session hijacking, credential theft, or other malicious actions within the web application.

The flaw affects WWBN AVideo versions 26.0 and earlier. No public patch is available at the time of publication.

The CVSS base score of 6.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed on the CISA KEV catalog. Exploitation requires the attacker to influence configuration values, which typically means having compromised an administrator account or successfully conducting a CSRF attack. The attack vector is likely local to the admin context, limiting the scope of impact to users with administrative privileges.