A stored cross-site scripting vulnerability in the AVideo CustomizeUser plugin allows authenticated administrators to execute arbitrary scripts, posing a significant risk to platform integrity.

This is a stored cross-site scripting (XSS) flaw (CWE-79) residing in the CustomizeUser plugin. Attackers with administrative privileges can inject malicious payloads via the field_name parameter in the add.json.php endpoint, which then execute when the typeToHTML function renders the data.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users or administrators. Given the CVSS score of 8.7, this is a high-severity issue that could lead to unauthorized administrative actions, session hijacking, or the defacement of the video platform.

Immediate Action: Monitor the official WWBN AVideo GitHub security advisories for the release of a patched version and apply it immediately upon availability.

Proactive Monitoring: Review web server access logs for anomalous activity directed at the add.json.php endpoint and monitor for unexpected changes to user profile forms.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and deploy a Web Application Firewall (WAF) to filter malicious input patterns in the field_name parameter.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant risk due to the potential for administrative account compromise via stored script injection. Security teams should prioritize patching as soon as the vendor provides a fix and enforce strict input validation for the affected plugin parameters in the interim.