Executive brief
The Meet plugin for AVideo, a video sharing and streaming platform, contains a security flaw that allows unauthenticated users to inject malicious scripts into the administrative dashboard. By joining a public meeting with a specially crafted browser identifier, an attacker can target meeting hosts or site administrators. If an administrator views the list of meeting participants, the malicious script executes in their browser, potentially allowing the attacker to perform actions on their behalf or steal sensitive session information.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the AVideo Meet plugin due to improper sanitization of the HTTP User-Agent header. When a user joins a public meeting via iframe.php, the Meet_join_log::log() function captures the raw User-Agent string and stores it in the database, bypassing the standard xss_esc() sanitization layer. This data is later retrieved by getMeetInfo.json.php and rendered in the 'Participants' management panel without output encoding (htmlspecialchars). An unauthenticated attacker can join a public meeting with a malicious User-Agent payload; when a meeting host or site administrator views the participant list, the payload executes in their privileged session. The vulnerability was reported as unpatched at the time of disclosure.
Affected products
- WWBN AVideo Meet plugin through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8
Timeline
- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-07-08: disclosed: NVD publication date