WWBN AVideo contains a stored XSS vulnerability in the LoginControl plugin due to improper neutralization of the User-Agent header before storing it in login history. This flaw allows attackers with valid login credentials to inject malicious scripts that execute in administrator browsers when they view the Login History page, enabling script execution within the administrator session. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. No patch or official remediation information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with any valid login to execute arbitrary scripts in the context of an administrator's browser session when the Login History page is viewed. This can lead to session hijacking, unauthorized actions, or other malicious activities within the administrator session. The vulnerability is critical due to the high impact on confidentiality, integrity, and availability as indicated by the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Login History page to trusted administrators only and consider monitoring for suspicious User-Agent header values. Avoid using administrator accounts to view login history if possible.