AVideo's registration form fails to sanitize the phone field, allowing an unauthenticated user to inject JavaScript. The injected script is stored in the database and later rendered via innerHTML on the administrators' user‑management page, causing the script to execute in an admin's browser session. This stored XSS can lead to credential theft, session hijacking, or other malicious actions within the administrative context. Based on the description, the likely attack vector is the publicly exposed registration endpoint, and the impact materializes when an authenticated administrator accesses the user list.

The affected product is AVideo from WWBN. Versions 14.2, 14.3, 14.3.1, 14.4, 18.0, 21.0, 22.0, 24.0, 25.0, 26.0, and 29.0 are vulnerable. All instances of AVideo running any of these versions are at risk.

The CVSS score of 5.1 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. Since the flaw is injected through an unauthenticated registration path and activates only when an administrator views the user list, successful exploitation requires a public registration endpoint to receive the payload and then an administrator session to trigger the script. Although the risk is moderate, the potential for attacker‑controlled code execution in privileged browser sessions warrants immediate attention.