WWBN AVideo contains a reflected XSS vulnerability in the showAlertMessage() function. The function inserts the raw Referer header into a JavaScript comment without encoding, allowing an attacker to close the comment prematurely using a crafted Referer header containing '*/' and inject arbitrary JavaScript code. This code executes in the security context of the vulnerable site for users who visit from the attacker-controlled page. The vulnerability affects version 0 of AVideo. No patch or remediation information is provided in the input data.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the vulnerable site for users who arrive from a maliciously crafted Referer header. This can lead to typical reflected XSS impacts such as session hijacking, defacement, or redirection to malicious sites. The CVSS score of 5.3 indicates a medium impact with low privileges required and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should be cautious about visiting untrusted links that could trigger this vulnerability. No vendor advisory or patch information is provided in the input data.