A critical stored cross-site scripting vulnerability in the WWBN AVideo AD_Server plugin enables unauthenticated attackers to hijack administrator sessions, posing a severe risk to platform integrity.

The vulnerability exists in the log.php endpoint of the AD_Server plugin, which fails to neutralize input in the label parameter. An unauthenticated attacker can inject malicious HTML or scripts that are subsequently rendered in the administrator's browser via jQuery .html(), leading to unauthorized code execution.

Successful exploitation allows an attacker to execute arbitrary JavaScript within the context of an administrator's browser session. This can lead to full administrative account takeover, unauthorized modification of video content, or the theft of sensitive session tokens and administrative data. Given the CVSS score of 9.3, this flaw is considered critical and represents a significant risk to the confidentiality and integrity of the AVideo platform.

Immediate Action: Review the vendor security advisory at the official GitHub repository and identify if a patch or update to a version beyond commit c3edcc274c389816d434acadac07ee78eaf330c1 is available.

Proactive Monitoring: Monitor server access logs for anomalous requests directed at the log.php endpoint of the AD_Server plugin, particularly those containing script tags or encoded HTML characters in the label parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize inputs containing suspicious HTML or JavaScript patterns directed at the log.php file.

Public Exploit Available: Unknown

This vulnerability presents a critical threat due to the potential for administrative account compromise via an unauthenticated vector. Administrators should prioritize the identification of a vendor-provided fix and apply it immediately upon release. In the interim, verify that the AD_Server plugin is restricted to trusted internal networks or disabled if not required for business operations.