The vulnerability is a client‑side cross‑site scripting flaw in the YPTSocket plugin of AVideo. When the plugin is enabled, an attacker can send specially crafted socket messages containing callback names that resolve to globally defined functions such as avideoConfirmHTML. Those functions accept untrusted data and assign it to innerHTML, thereby executing attacker‑supplied JavaScript in the browser of any user who receives the message. The flaw does not require prior authentication or user interaction, so any user connected to the websocket endpoint is a potential victim. The consequences are limited to the victim’s browser session but can be used to steal session cookies, deface content, or perform further phishing attacks from the same origin.

AVideo installations that have the YPTSocket plugin enabled are affected. No specific product version was supplied, so any publicly released AVideo package with this plugin should be considered vulnerable until a patch is applied.

With a CVSS score of 6.9 the vulnerability is considered moderate. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Attackers would need to trigger the vulnerable websocket endpoint, which is accessible to unauthenticated clients, so the likelihood of exploitation depends on the exposure of that service. The attack vector is inferred from the description: the attacker sends crafted websocket messages that resolve to global callbacks. Due to the lack of authentication requirements, any user connecting via websockets can be targeted, increasing the potential impact.