WWBN AVideo version 29.0 contains an improper neutralization of input vulnerability in the phone field during user registration. The lack of sanitization allows attackers to inject persistent malicious JavaScript. This script executes in the context of an administrator's browser when the users management page renders the unsanitized phone field using innerHTML, leading to a stored cross-site scripting attack.

An attacker can inject malicious scripts that execute in the administrator's browser session, potentially leading to session hijacking, unauthorized actions, or disclosure of sensitive information accessible to the admin. The vulnerability requires no authentication to inject the payload but relies on an administrator visiting the affected page to trigger execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid visiting the users management page or use browser-based script-blocking extensions to mitigate risk. Input validation and output encoding should be implemented to sanitize the phone field properly.