AVideo: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute (CVE-2026-45580) | HOL Guard CVE