Malicious-site redirection via unsanitized display name

HTML injection in Zoom clients before 5.13.10 allows remote attackers to redirect meeting creators to a malicious website. The client renders attacker-controlled HTML embedded in a participant display name without neutralizing it during meeting creation. Successful exploitation requires a meeting creator to encounter and interact with the injected content; the documented consequence is navigation to an attacker-selected site.