The vulnerability in WWBN AVideo is a reflected XSS (CWE-79) caused by improper neutralization of user input in the 'search' query parameter used in YouTubeAPI Gallery Pagination links. The parameter is concatenated directly into href attributes without htmlspecialchars, urlencode, or allow-list validation. Injected script elements are then extracted and executed inline by the AVideo Layout plugin, enabling arbitrary JavaScript execution under the AVideo origin. This can be exploited by unauthenticated attackers via crafted URLs to perform actions as the victim, including administrative actions if the victim has admin privileges. The issue affects versions prior to 29.0 and has been patched in a commit referenced in the description.

An unauthenticated attacker can exploit this vulnerability by tricking a victim into visiting a maliciously crafted URL, resulting in arbitrary JavaScript execution within the victim's browser under the AVideo origin. This can lead to theft of non-HttpOnly cookies and issuance of authenticated AJAX requests on behalf of the victim. If the victim is an administrator, the attacker can perform any cookie-authenticated admin action, including creating users, promoting users to admin, changing configuration, and installing plugins, effectively allowing full administrative takeover of the application.

A patch addressing this vulnerability has been committed by the WWBN AVideo project (commit f50fc033b7adb36f1ffd6640e7826468bdafdec3). Users should upgrade to version 29.0 or later where this issue is fixed. Since this is not a cloud service, remediation requires applying the official fix. Patch status is confirmed by the vendor commit. Until patched, avoid clicking on untrusted URLs containing the 'search' parameter in the affected application.