WWBN AVideo contains a reflected XSS vulnerability in the confirmLivePassword.php plugin script. The GET parameter 'u' is not sanitized or encoded before being interpolated into an <img src="..."> attribute. By injecting a double-quote character in 'u' along with a non-empty 'key' parameter and absence of a valid 'c' parameter, an attacker can break out of the src attribute and inject an additional HTML tag with an onerror JavaScript handler. This allows execution of arbitrary JavaScript in the context of the affected site for any user who clicks the crafted link.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the browsers of users who open the malicious link, potentially leading to session hijacking, credential theft, or other actions performed with the privileges of the victim user, including administrators. The vulnerability requires user interaction (clicking a crafted link) and does not require authentication.

No official patch or fix was available at the time of the advisory. Users and administrators should exercise caution when clicking links involving the vulnerable parameter. Monitor the vendor's advisories for updates and patches. Consider implementing web application firewall (WAF) rules to detect and block malicious payloads targeting this parameter until an official fix is released.