An incomplete mitigation in WWBN AVideo versions up to 29.0 allows an attacker who can obtain a WebSocket token to inject malicious JavaScript via the autoEvalCodeOnHTML sink. The token is retrieved from an unauthenticated plugin endpoint, enabling a WebSocket connection that transmits a message containing the code under a top‑level json field. Because the server skips the stripping logic for the $msg['json'] payload, the code is forwarded unchanged to any logged‑in user identified by to_users_id, and the client evaluates it, giving the attacker code execution on the victim’s browser. This constitutes a execution of arbitrary payload (CWE‑94).

WWBN AVideo, all releases through version 29.0 inclusive. Any instance deploying the YPTSocket plugin and not patched is vulnerable.

The CVSS score of 7.2 indicates high severity, while EPSS data is not provided, leaving the current exploitation probability uncertain. The vulnerability is not in the CISA KEV catalog, but the combination of an unauthenticated WebSocket token and a sink that executes client‑side JavaScript points to a realistic attack path for malicious actors who can target active AVideo installations.