WWBN AVideo contains a stored XSS vulnerability in the UserGroups::setGroup_name() method due to improper sanitization of the group_name input. Administrators with the canAdminUserGroups permission can inject malicious scripts that execute in the browsers of other administrators viewing the user manager interface. This vulnerability is present in version 0 of the product. No patch or remediation information is provided in the input data.

An attacker with administrative privileges to manage user groups can inject malicious scripts that execute in the browsers of other administrators. This can lead to session hijacking, privilege escalation, or other attacks within the administrative interface. The vulnerability is critical given the high CVSS score and the potential for administrative account compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative permissions to trusted users only and monitor for suspicious activity related to user group management. Avoid exposing the user manager interface to untrusted networks.