A stored cross-site scripting vulnerability in the WWBN AVideo LoginControl plugin allows authenticated attackers to perform unauthorized actions within an administrator's browser session.

This is a stored cross-site scripting (XSS) vulnerability occurring within the LoginControl plugin. Any authenticated user can inject malicious scripts into the User-Agent header, which subsequently executes when an administrator views the login history.

The ability to execute arbitrary scripts within an administrator session poses a significant risk to the integrity and confidentiality of the AVideo platform. With a CVSS score of 8.7, this flaw is categorized as high severity because it enables session hijacking or unauthorized administrative actions, which could lead to full system compromise or data exfiltration.

Immediate Action: Monitor the official WWBN AVideo GitHub repository for a security patch or updated release, and apply it as soon as it becomes available.

Proactive Monitoring: Review web access logs for unusual User-Agent strings and inspect the Login History page for signs of injected script tags or anomalous entries.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter or sanitize the User-Agent header, effectively blocking common XSS payloads before they reach the application.

Public Exploit Available: No (exploit_available unknown).

Given the high CVSS score and the potential for privilege escalation via administrative session hijacking, this vulnerability represents a significant security risk. Security teams should prioritize patching as soon as the vendor releases a fix and ensure that access controls are strictly managed to prevent unauthorized users from reaching the vulnerable interface.