AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel
Date: 2026-06
Affected: composer/wwbn/avideo
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-79

### Summary The Meet plugin stores the raw HTTP `User-Agent` header of every meeting participant and later renders it without output encoding in the meeting-management ("Participants") panel that the meeting host and site administrators open. An anonymous, unauthenticated attacker can join any public meeting while sending a `User-Agent` header containing an HTML payload. The payload is persisted in `meet_join_log.user_agent` and, when the host or an administrator opens the participant list, is injected verbatim into their DOM, executing attacker-controlled JavaScript in a privileged, authenticated session. This is a cross-privilege stored XSS: an anonymous visitor obtains script execution in the administrator's browser. ### Affected versions `WWBN/AVideo` at current `master` commit `e8d6119f3cb1b849149906efeb0a41fc024f59f8` (and prior releases shipping the same code path). Not patched at the time of this report. ### Privilege required - **Writer (attacker):** unauthenticated / anonymous. Joining a public meeting requires no account and no password. - **Victim (trigger):** the meeting host or any site administrator who opens the meeting's participant-management panel. ### Vulnerable code (file:line) The stored value is never sanitized on write, then echoed without encoding on read. Write path — `plugin/Meet/Objects/Meet_join_log.php:147`: ```php public function setUser_agent($user_agent) { $this->user_agent = $user_agent; } ``` Write path — `plugi


Mitigations:

Architectural layers (MAESTRO):