AVideo, through commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability in its LiveLinks plugin. The vulnerability arises because the title and description fields are stored without proper sanitization. A user with canStream permission can inject malicious JavaScript code that executes in the browsers of all visitors and administrators who view the live-link page, within the same site origin. This can lead to significant security risks including session hijacking or unauthorized actions performed in the context of the victim's browser session. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond canStream, user interaction required, high impact on confidentiality, integrity, and availability, and no scope change.

Successful exploitation allows attackers with canStream permission to execute arbitrary scripts in the browsers of all visitors and administrators viewing the live-link page. This can lead to theft of sensitive information, session hijacking, or unauthorized actions performed with the privileges of the victim user within the site origin. The vulnerability affects the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict canStream permissions to trusted users only and consider disabling or restricting use of the LiveLinks plugin to reduce exposure.