The vulnerability arises from the Meet plugin of WWBN AVideo, where the user and pass query parameters are directly echoed into a JavaScript string literal without proper escaping. An attacker can craft a URL that injects a closing quote and arbitrary JavaScript code, causing the victim’s browser to execute that code within the AVideo domain. This enables session hijacking, credential theft, or other attacks that rely on executing code in the victim’s context. The weakness is an input validation failure (CWE‑79).

Affected installations are WWBN AVideo versions 29.0 and earlier. The vulnerability is present in the plugin/Meet/iframe.php script where the parameters are reflected. Upgrading to a version that includes the commit 3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b resolves the issue.

The CVSS score is 6.1, indicating a moderate severity risk. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation reports yet. However, the flaw does not require authentication and can be triggered by any user who visits a malicious URL to a Meet that is publicly scheduled, making it a realistic threat for exposed installations.