A stored cross-site scripting vulnerability in WWBN AVideo allows authenticated users to execute malicious scripts, posing a severe risk of account takeover or administrative compromise.

This is a stored cross-site scripting (XSS) flaw occurring within the donationLink profile field. An authenticated user can bypass input validation to inject malicious event handlers, which are then rendered unencoded in the browser of any user, including administrators, who interacts with the donation button.

The ability to execute arbitrary JavaScript in the context of an administrative session constitutes a critical security risk. Successful exploitation could lead to full administrative account takeover, unauthorized modification of site content, or the exfiltration of sensitive session data, resulting in significant operational disruption and reputational damage. The CVSS score of 8.7 reflects the high potential for impact on both confidentiality and integrity.

Immediate Action: As no official patch is currently available, users should disable the 'allowDonationLink' option within the CustomizeUser plugin to mitigate the attack vector.

Proactive Monitoring: Security teams should monitor web server logs for suspicious profile update activity and review browser-based console errors or unexpected script executions on the watch page.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict script execution sources and deploy a Web Application Firewall (WAF) configured to detect and block malicious XSS payloads targeting the donationLink parameter.

Public Exploit Available: Unknown

Given the potential for administrative compromise, this vulnerability poses a significant risk to the integrity of the AVideo platform. Administrators are urged to disable the vulnerable feature immediately and monitor vendor security advisories for the release of a permanent fix. Do not re-enable the donation link functionality until the software has been updated to a version that properly sanitizes and encodes user input.