AVideo’s Live_schedule::setTitle() and setDescription() methods store incoming data without sanitization, enabling an attacker to embed malicious scripts. An unauthenticated user can then access the remindMe.php page, causing stored XSS payloads to execute in the browsers of victims who view that page. This client‑side execution of arbitrary code can lead to credential theft, session hijacking or defacement in affected browsers.

The vulnerability applies to AVideo installations provided by WWBN. No specific version information is available, so any publicly accessible AVideo deployment is potentially impacted.

The CVSS score of 5.1 indicates a moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that no large‑scale exploits have yet been reported. The attack vector is unauthenticated, leveraging the public remindMe.php endpoint; however, crafting the malicious payload requires the ability to create or edit live schedule titles or descriptions, which may be limited to users with streaming permissions. Despite the moderate score, the ability to execute arbitrary client‑side code makes this vulnerability significant for accounts that rely on browser security.