The vulnerability in WWBN AVideo arises from improper neutralization of input during web page generation in the AD_Server plugin's log.php endpoint. Specifically, the label parameter is stored without proper escaping and later rendered unsanitized in the admin interface using jQuery .html(), leading to stored cross-site scripting. This allows an unauthenticated attacker to inject malicious scripts that execute in the context of an administrator's browser session, potentially compromising administrative control.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session. This can lead to session hijacking, unauthorized actions performed with administrator privileges, and potential compromise of the administrative interface. The CVSS 4.0 score of 9.3 reflects the critical severity and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, administrators should exercise caution when accessing the affected admin Ad Types report and consider restricting access to trusted personnel only.