AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

5.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P · score source

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary The Meet plugin stores the raw HTTP User-Agent header of every meeting participant and later renders it without output encoding in the meeting-management ("Participants") panel that the meeting host and site administrators open. An anonymous, unauthenticated attacker can join any public meeting while sending a User-Agent header containing an HTML payload. The payload is persisted in meetjoinlog.useragent and, when the host or an administrator opens the participant list, is injected verbatim into their DOM, executing attacker-controlled JavaScript in a privileged, authenticated session. This is a cross-privilege stored XSS: an anonymous visitor obtains script execution in the administrator's browser. Affected versions WWBN/AVideo at current master commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 (and prior releases shipping the same code path). Not patched at the time of this report. Privilege required - Writer (attacker): unauthenticated / anonymous. Joining a public meeting…

Published by the source

23 Jun 2026, 19:11 UTC

Last modified by the source

23 Jun 2026, 20:41 UTC

Source last checked

26 Oct 2026, 14:49 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-7cqp-7cfv-6c3q

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-7cqp-7cfv-6c3q

Advisory: AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel
IDs: GHSA-7cqp-7cfv-6c3q
Record: https://patchnext.com/advisories/ghsa-7cqp-7cfv-6c3q (revision 1, source checked 26 Oct 2026, 14:49 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 5.4)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor response not established. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist wwbn/avideo: affected <= 29.0

## Suggested inspection (read-only)
- Packagist wwbn/avideo: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on wwbn/avideo.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-7cqp-7cfv-6c3q (GitHub-reviewed advisory GHSA-7cqp-7cfv-6c3q lists affected ranges: Packagist wwbn/avideo >=0 <=29.0)

Commands are suggestions: review each one before running it.