WWBN AVideo, an open source video platform, contains a cross-site scripting vulnerability (CWE-79) in its YPTWallet Stripe payment confirmation page in versions up to 26.0. The vulnerability occurs because the `plugin` parameter from the `$_REQUEST` superglobal is echoed directly into a JavaScript block without any encoding or sanitization, bypassing the framework's input filters. This allows an attacker to inject arbitrary JavaScript code by sending a crafted URL to a victim. The injected script can access sensitive information such as the victim's username and password hash via calls to `User::getUserName()` and `User::getUserPass()`. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity. A code commit (fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2) addresses and fixes this issue.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the context of a victim user visiting the malicious URL. This can lead to theft of sensitive user information, specifically the victim's username and password hash, which are exposed in the vulnerable script block. The vulnerability does not require privileges or authentication and can be triggered via user interaction (clicking a crafted link). There is no indication of known exploits in the wild at this time.

A fix for this vulnerability is available and has been implemented in the codebase as of commit fa0bc102493a15d79fe03f86c07ab7ca1b5b63e2. Users and administrators of WWBN AVideo should upgrade to a version that includes this fix or apply the patch from the referenced commit. Until patched, avoid clicking on untrusted links that may contain malicious `plugin` parameters. Patch status beyond the commit is not explicitly stated; verify with the vendor or official WWBN AVideo repositories for the latest patched release.