An attacker can set a malicious display name for the caller in the YPTSocket plugin of AVideo. The plugin renders this name directly into a toast heading using raw HTML and jQuery's .html() method. Because no sanitization occurs, the browser parses and executes any injected script, allowing arbitrary code execution in the victim’s browser. This leads to session hijacking, data theft, or delivery of malware, with no user interaction beyond receiving a call.

The vulnerability exists in the WWBN AVideo open‑source video platform, affecting all releases 26.0 and older. No other versions or variants are noted.

The CVSS base score is 6.4, indicating a moderate to high severity. The EPSS score is below 1% and the issue is not listed in CISA’s KEV catalog, so the overall likelihood of exploitation is low at present. However, the attack vector is inferred to be via an active WebSocket connection; an attacker can trigger the vulnerable toast by initiating a call to a victim without any further action on the victim’s part. Without a published patch, this remains a high‑value target for automated scripts that can scan for vulnerable installations.