WWBN AVideo, an open source video platform, suffers from an improper input neutralization vulnerability (CWE-79) in versions up to 29.0. Specifically, the plugin/Meet/iframe.php script echoes the 'user' and 'pass' parameters directly into a JavaScript double-quoted string literal without escaping. This flaw enables an attacker to break out of the string context and execute arbitrary JavaScript code in the context of the victim's browser session. The attack requires no authentication if a public Meet schedule exists. The vulnerability has a CVSS 3.1 base score of 6.1, indicating a medium severity. A code commit (3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b) contains an updated fix, but no official patch or vendor advisory is currently available.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the AVideo origin, potentially leading to session hijacking, information disclosure, or other client-side attacks. The vulnerability does not require authentication if a public Meet schedule is configured, increasing the attack surface. The CVSS score of 6.1 reflects a medium impact on confidentiality and integrity, with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A code commit with a fix exists, so users should monitor WWBN's official channels for an official patch release and apply it promptly. Until patched, avoid exposing public Meet schedules or restrict access to trusted users to reduce risk.