A stored cross-site scripting vulnerability in the WWBN AVideo LiveLinks plugin allows authenticated users to execute malicious scripts in the browsers of visitors, including administrators.

This vulnerability is a stored cross-site scripting (CWE-79) flaw affecting the LiveLinks plugin, where title and description fields lack proper input sanitization. An authenticated user possessing canStream permissions can inject arbitrary scripts that execute within the context of any user viewing the affected page.

The exploitation of this vulnerability poses a significant risk to organizational security, as it allows attackers to hijack administrator sessions or perform unauthorized actions on behalf of privileged users. Given the high CVSS score of 8.7, this flaw could lead to full account takeover or sensitive data exposure within the AVideo platform. Such compromises threaten the integrity of the application and the confidentiality of user information.

Immediate Action: Consult the vendor advisory at the official GitHub security page to determine if a patch or configuration workaround is available for your specific deployment.

Proactive Monitoring: Review application access logs for unusual activity involving the LiveLinks plugin and monitor for unexpected script injection patterns in page titles or descriptions.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the sources from which scripts can be executed and deploy a Web Application Firewall (WAF) to detect and block malicious script payloads.

Public Exploit Available: No (exploit_available: false)

Due to the high severity and the potential for administrative session hijacking, organizations using the LiveLinks plugin should prioritize the identification and mitigation of this flaw. If a vendor update is not yet available, restrict canStream permissions to trusted users only and apply robust input filtering at the application gateway level until a permanent patch can be deployed.