A vulnerable input field in the AD_Server plugin allows an unauthenticated attacker to inject malicious HTML through the label parameter of log.php. The data is stored without escaping and later rendered by the admin Ad Types report using jQuery .html(), causing plain JavaScript to execute when an administrator views the report. This flaw is a classic stored cross‑site scripting attack (CWE‑79) that can expose confidential data, hijack.

The vulnerability exists in AVideo deployments that include the AD_Server plugin and are running code prior to commit c3edcc274c389816d434acadac07ee78eaf330c1. Any installation using that version of the plugin is susceptible until the offending input is properly sanitized. This includes all AVideo installations utilizing the AD_Server plugin, as identified by the vendor WWBN.

The CVSS score of 9.3 indicates a high severity condition with the potential for arbitrary JavaScript execution in authenticated administrator sessions. EPSS data is not available, but the flaw is exposed through an unauthenticated endpoint, so the likelihood of exploitation is significant. The vulnerability is not listed in the CISA KEV catalog, yet it presents a strong candidate for exploitation once a public exploit becomes available. An attacker would need to submit a payload to log.php and then lure an administrator to view the Ad Types report to trigger the stored malicious script.