Vulnerabilities

Security incident · CVE-2026-54458

WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

Published Jun 4, 2026 · catalog updated Oct 29, 2026 · WWBN AVideo: Unauthenticated Stored

Last checked Oct 30, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-54458. EPSS is 0.38%. Act only if a listed version of WWBN AVideo: Unauthenticated Stored is installed.

Severity

Critical9.6

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.38%

Remediation

Advisory link

Affected products

Packagist WWBN/AVideo

## Summary A stored DOM Cross-Site Scripting vulnerability (CWE-79) in the AVideo YPTSocket plugin lets any unauthenticated remote attacker execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. issues a signed WebSocket token to any anonymous caller, and at lines 91 and 110 reads the attacker-controlled and query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite table and broadcast inside the array sent to every connected client; on the client, interpolates the broadcast into an HTML template literal that is passed to jQuery , which parses attacker bytes into live DOM nodes including with inline event handlers. ## Details issues a WebSocket token to any caller; the only gate is . The token-issuance helper at writes directly into the per-token state without validation: On WebSocket open, reads and from the connection URL query string and persists both verbatim into the in-memory SQLite table: is not an HTML encode. The broadcast helper ( ) selects both columns without escape and returns them as part of , which at places in the outbound JSON frame sent to every connected client. JSON encoding escapes to for transport, but the receiving browser's reverses the escape and restores the raw HTML bytes before they reach . On the client, (lines 638 to 700) interpolates the broadcast into an HTML template literal and passes the result to jQuery : jQuery's parses the string with the browser HTML parser, building live DOM nodes for any tag the attacker supplied, including with inline event handlers. The browser's load attempt on the attacker-supplied fails and the inline event handler fires synchronously inside the admin's authenticated origin. The victim precondition is that the YPTSocket online-users debug panel ( ) is rendered in the admin's DOM. renders the panel when . The plugin flag is by default after enable