A stored cross-site scripting vulnerability in the AVideo LoginControl plugin allows authenticated attackers to execute malicious scripts within an administrator session, posing a severe risk to platform integrity.

This is a stored cross-site scripting (CWE-79) flaw where the application fails to properly neutralize PGP public key input. The vulnerability is exploitable by an authenticated user who can inject malicious JavaScript into a textarea element, which then executes when an administrator views the affected user profile.

The exploitation of this vulnerability allows an attacker to compromise administrative sessions, potentially leading to unauthorized configuration changes, full site takeover, or further malicious activity within the AVideo environment. Given the high CVSS score of 8.7, this vulnerability represents a significant risk to the confidentiality and integrity of the application, as it facilitates privilege escalation via session hijacking.

Immediate Action: Monitor the official WWBN AVideo GitHub security advisories for the release of a patched version and apply the update immediately upon availability.

Proactive Monitoring: Review application access logs for suspicious profile update activity and monitor for anomalous JavaScript execution patterns within the administrative dashboard.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect and block malicious payloads submitted via the PGP public key field.

Public Exploit Available: Unknown.

Given the potential for full administrative session compromise, this vulnerability poses a high risk to the AVideo platform. Administrators should prioritize the identification and mitigation of this flaw, including restricting access to profile modification features until a patch is verified and applied.