The vulnerability resides in the testIP.php page of the User_Location plugin where the ip request parameter is reflected directly into an HTML input field without applying any output encoding. This omission allows an attacker to inject arbitrary HTML and JavaScript into the page, leading to a reflected cross‑site scripting (XSS) flaw.

The flaw affects the open‑source AVideo video platform produced by WWBN. Versions 26.0 and earlier of the platform, when the User_Location plugin is installed, are vulnerable. The testIP.php script is intended for use only by administrator users.

The CVSS score of 6.1 indicates a medium severity vulnerability. The EPSS score is below 1%, and the flaw is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. However, because the platform sets SameSite=None for its authentication cookies, a malicious URL containing a crafted ip value can be used to lure an administrator to execute JavaScript in the context of their authenticated session. The likely attack vector is a phishing or social engineering attempt that convinces an admin to click the malicious link.