The vulnerability in AVideo (commit c3edcc274c389816d434acadac07ee78eaf330c1) involves improper neutralization of input during web page generation. The CustomizeUser plugin stores the field_name parameter raw without sanitization, enabling stored XSS attacks. Administrators can exploit this by injecting malicious scripts through the add.json.php endpoint, which execute in the context of users viewing affected pages that use the typeToHTML function.

Successful exploitation allows an attacker with administrator privileges to inject and execute arbitrary scripts in the context of users viewing certain pages, potentially leading to session hijacking, privilege escalation, or other malicious actions. The CVSS 4.0 score of 9.3 indicates a critical severity with high impact on confidentiality, integrity, and availability.

No patch or official fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel and monitor for suspicious activity related to the CustomizeUser plugin and add.json.php endpoint.