WWBN AVideo versions 26.0 and prior contain an improper neutralization of input vulnerability (CWE-79) in the User_Location plugin's testIP.php page. The ip parameter is directly injected into an HTML input element without htmlspecialchars() or equivalent encoding, enabling injection of arbitrary HTML and JavaScript. Despite the page's admin-only restriction, the SameSite=None cookie configuration permits cross-origin attacks, allowing an attacker to execute script in the context of an authenticated admin session via a crafted URL. This vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity. No official patches or fixes are currently available.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated admin user session. This can lead to limited confidentiality and integrity impacts, such as theft of admin session data or manipulation of admin interface elements. The vulnerability does not affect availability. The cross-origin exploitability is enabled by the SameSite=None cookie setting, increasing the attack surface despite the admin-only page restriction.

At the time of publication, no official patches or fixes are available for this vulnerability. Users should monitor the vendor's advisory channels for updates. As a temporary measure, restricting access to the affected testIP.php page to trusted networks or disabling the User_Location plugin may reduce risk. Additionally, reviewing and adjusting cookie SameSite settings to a more restrictive policy could help mitigate cross-origin exploitation. Avoid clicking on untrusted links that could trigger this vulnerability in admin sessions.