WWBN AVideo versions 26.0 and prior contain an XSS vulnerability due to improper neutralization of input during web page generation. Specifically, the jsonToFormElements() function in admin/functions.php directly inserts user-controlled plugin configuration values into HTML form elements without applying htmlspecialchars() or equivalent output encoding. This allows an attacker who can modify plugin configuration values to inject arbitrary JavaScript, which executes when an administrator accesses the plugin configuration page. Exploitation requires either compromised admin credentials or chaining with a CSRF attack against admin/save.json.php. No official patch or fix is currently available.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the administrator's browser when they visit the plugin configuration page. This can lead to session hijacking, credential theft, or other actions performed with administrator privileges within the web application. The vulnerability does not affect availability and requires user interaction (administrator visiting the page).

At the time of publication, no official patch or fix is available for this vulnerability. Administrators should restrict access to the admin panel to trusted users only and consider additional protections against CSRF attacks. Monitor vendor advisories for updates regarding patches or official remediation guidance.