The YPTSocket plugin in WWBN AVideo versions 29.0 and earlier forwards attacker‑supplied JSON message bodies to all connected clients without any sanitization. Two eval() sinks on the client side—one that evaluates code contained in the JSON field autoEvalCodeOnHTML and another that evaluates the JSON field callback—can be triggered by the data sent through these messages. An attacker can thus broadcast arbitrary JavaScript that is executed in the context of every user currently connected to the WebSocket server, including administrators. This enables universal account takeover, session hijacking, and execution of privileged actions. The vulnerability is effective even for unauthenticated users because tokens minted for anonymous visitors are not revalidated beyond decryption, allowing the attacker to deliver malicious payloads without first authenticating.

WWBN AVideo, specifically the YPTSocket plugin in releases 29.0 and earlier. The fix was included in commit c08694bf6264eb4decceb78c711baee2609b4efd, which removed the unsanitized eval sinks and added proper validation.

This weakness corresponds to CWE‑94 code injection and carries a CVSS score of 10, indicating critical severity. The EPSS score is not available, but the lack of an EPSS rating does not diminish the inherent risk presented by the ability to inject and execute code on all connected clients. The vulnerability is not listed in the CISA KEV catalog, yet the attack requires only a WebSocket connection to the vulnerable plugin; an unauthenticated attacker can trigger the exploit without needing elevated privileges or prior knowledge of user credentials. The combination of a high severity rating, the lack of authentication checks, and the widespread use of WebSocket connections makes exploitation highly likely in exposed deployments.