GHSA-7cqp-7cfv-6c3q: AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

The Meet plugin stores the raw HTTP User-Agent header of every meeting participant and later renders it without output encoding in the meeting-management (“Participants”) panel that the meeting host and site administrators open. An anonymous, unauthenticated attacker can join any public meeting while sending a User-Agent header containing an HTML payload. The payload is persisted in meet_join_log.user_agent and, when the host or an administrator opens the participant list, is injected verbatim into their DOM, executing attacker-controlled JavaScript in a privileged, authenticated session. This is a cross-privilege stored XSS: an anonymous visitor obtains script execution in the administrator’s browser.