CVE-2026-54458

A stored DOM Cross‑Site Scripting flaw exists in the YPTSocket plugin of the AVideo open‑source video platform. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online‑users debug panel. This occurs when the attacker calls the getWebSocket.json.php endpoint, receives a signed WebSocket token, and then opens a WebSocket connection supplying attacker‑controlled query parameters such as webSocketSelfURI and page_title. The MessageSQLiteV2 class in the plugin reads these parameters from the connection URL without validation, persists them in an in‑memory SQLite table, and broadcasts the page_title payload to every connected client. On the client side, updateSocketUserCard interpolates the received page_title into an HTML template literal and appends it to the DOM with jQuery’s $.append. Because no escaping occurs, the attacker can inject arbitrary HTML and JavaScript, including event handlers on an <img> tag. When an administrator views the debug panel, the injected script runs with the administrator’s credentials, allowing the attacker to read non‑HttpOnly cookies and the CSRF token, issue authenticated requests to admin‑only endpoints, exfiltrate the dashboard DOM, and ultimately gain full administrative control of the system. The weakness is a classic Stored XSS (CWE‑79).

All releases of WWBN AVideo prior to version 29.0 are affected, as the flaw resides in the YPTSocket plugin’s WebSocket handling code. Users running any supporting edition of the platform before the 29.0 release must consider an update or mitigation.

The CVSS score of 9.6 signals a critical impact, while the EPSS score of less than 1 % suggests that, to date, exploitation is rare. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the publicly accessible WebSocket endpoint without authentication, craft a malicious page_title value, and cause any administrator currently on the online‑users debug panel to execute the payload. With the attacker’s code running under the administrator’s session, full administrative takeover is attainable with a single anonymous WebSocket connection.