GHSA-7cqp-7cfv-6c3q

### Summary The Meet plugin stores the raw HTTP `User-Agent` header of every meeting participant and later renders it without output encoding in the meeting-management ("Participants") panel that the meeting host and site administrators open. An anonymous, unauthenticated attacker can join any public meeting while sending a `User-Agent` header containing an HTML payload. The payload is persisted in `meet_join_log.user_agent` and, when the host or an administrator opens the participant list, is injected verbatim into their DOM, executing attacker-controlled JavaScript in a privileged, authenticated session. This is a cross-privilege stored XSS: an anonymous visitor obtains script execution in the administrator's browser. ### Affected versions `WWBN/AVideo` at current `master` commit `e8d6119f3cb1b849149906efeb0a41fc024f59f8` (and prior releases shipping the same code path). Not patched at the time of this report. ### Privilege required - **Writer (attacker):** unauthenticated / anonymous. Joining a public meeting requires no account and no password. - **Victim (trigger):** the meeting host or any site administrator who opens the meeting's participant-management panel. ### Vulnerable code (file:line) The stored value is never sanitized on write, then echoed without encoding on read. Write path — `plugin/Meet/Objects/Meet_join_log.php:147`: ```php public function setUser_agent($user_agent) { $this->user_agent = $user_agent; } ``` Write path — `plugin/Meet/Objects/Meet_join_log.php:177`: ```php public static function log($meet_schedule_id) { $log = new Meet_join_log(0); $log->setIp(getRealIpAddr()); $log->setMeet_schedule_id($meet_schedule_id); $log->setUser_agent((isMobile() ? "Mobile: " : "") . get_browser_name()); $log->setUsers_id(User::getId()); return $log->save(); } ``` `get_browser_name()` (`objects/functionsBrowser.php:239` and `:242`) returns the original-case `User-Age