A stored cross-site scripting vulnerability in the WWBN AVideo Bookmark plugin poses a high risk of unauthorized script execution and potential account compromise for platform users.

The vulnerability exists in the Bookmark plugin due to improper neutralization of input, where chapter names are not encoded before being rendered on public watch pages. An authenticated user with video owner privileges can trigger this cross-site scripting flaw by injecting malicious payloads into the bookmark name parameter.

The ability to execute arbitrary JavaScript in the context of the AVideo origin allows attackers to hijack user sessions, perform unauthorized actions on behalf of visitors, or redirect traffic to malicious sites. Given the CVSS score of 8.7, this flaw represents a significant risk to data integrity and user security, potentially leading to widespread account takeovers within the platform.

Immediate Action: Review the official security advisory at the WWBN GitHub repository for updates and apply any available patches to the AVideo instance immediately. If a direct patch is not available, disable the Bookmark plugin to neutralize the attack vector.

Proactive Monitoring: Monitor web server access and application logs for suspicious characters or script tags appearing within bookmark or chapter name parameters.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common XSS patterns in incoming requests.

Public Exploit Available: Unknown.

The high severity of this vulnerability necessitates immediate attention from administrators to prevent potential session hijacking and cross-site attacks. Organizations should prioritize updating their AVideo deployments or disabling the vulnerable Bookmark plugin until a verified fix is implemented to ensure the security of their user base.