A video platform contains a stored cross‑site scripting flaw that allows an attacker to embed malicious code in the stream key for a live broadcast. When the key is stored, the software echoes it directly into an HTML class attribute without escaping. Any person who visits the live page – whether logged in or anonymous – will execute the embedded JavaScript in the context of the site. This can lead to theft of credentials, session hijacking or other malicious actions within the platform’s domain.

The vulnerability exists in the open source video platform provided by WWBN in all releases version 29.0 and earlier. It is triggered via the Live plugin’s YouTube‑style view and can be introduced through the Live/saveLive.php interface by any user with canStream permissions. All downstream users who access the affected stream’s page are potentially exposed.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker requires the ability to add or edit a stream key, which is granted to users with canStream permissions. Once a malicious key is stored, any visitor to the live page triggers the payload, making exploitation straightforward for attackers who can create or manipulate live streams. The lack of request‑time validation and proper output encoding directly contributes to the risk of exploitation.