This vulnerability involves stored XSS in Revive Adserver where malicious JavaScript payloads embedded in usernames are executed when an admin views audit log details. The root cause is the lack of output sanitization on usernames in the audit log display. The vendor has implemented proper escaping to mitigate this risk.

If exploited, an attacker could execute arbitrary JavaScript in the context of an admin user's browser when viewing audit logs. This could lead to session hijacking or other client-side attacks. However, the vulnerability requires the attacker to control or influence usernames and for an admin to view the malicious audit log entries.

The vendor has applied proper escaping to the audit log details output to prevent execution of malicious scripts. No additional remediation level or patch information is provided, but the fix appears implemented. Users should ensure they are running a version with this escaping applied. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.