An input parameter called link in the videoEmbeded.php script is echoed within an HTML comment without any escaping. An attacker can close the comment with --> and inject arbitrary JavaScript. When a victim visits the crafted embed URL the injected script runs in the victim's browser, enabling session hijacking, credential theft or other client‑side attacks. The vulnerability is a reflected XSS flaw, aligned with CWE‑79.

The affected product is WWBN:AVideo. The vulnerability appears in the code base associated with commit c91b5975d. No specific version numbers are listed, so any released AVideo installation that has not applied the commit is potentially impacted.

The CVSS v3 score of 5.3 indicates a moderate impact. EPSS data are not available and the issue is not listed in CISA KEV, suggesting a lower known exploitation probability at present. Exploitation can be achieved simply by creating a malicious link and directing a user to that URL. The impact centers on client‑side execution and can compromise user sessions or data visible in the browser. The lack of a current KEV listing does not preclude exploitation, especially given the straightforward attack vector described.