# CVE-2026-54458: WWBN AVideo stored DOM XSS in YPTSocket plugin

Source: https://junglewise.ai/threats/cve-2026-54458-wwbn-avideo-stored-dom-xss-in-yptsocket-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-54458 · Severity: critical · CVSS 9.6 · Published 2026-07-15

WWBN AVideo, an open-source video sharing platform, contains a security flaw in its YPTSocket plugin. An unauthenticated attacker can inject malicious scripts that automatically execute in the browsers of site administrators. This allows the attacker to hijack administrative sessions, steal sensitive data, and gain full control over the video platform.

Technologies: [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo), [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-54458 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54458 being exploited in the wild.

**How severe is CVE-2026-54458?** Critical severity, with a CVSS score of 9.6, published 15 July 2026.

**Which products and versions are affected?** wwbn/avideo (Packagist) ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo Prior to 29.0.

**Is there a fix for CVE-2026-54458?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-54458 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-54458?** Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored DOM Cross-Site Scripting (XSS) vulnerability exists in the YPTSocket plugin of WWBN AVideo due to improper validation of WebSocket connection parameters. An unauthenticated attacker can obtain a signed WebSocket token via 'getWebSocket.json.php' and connect to the WebSocket server with malicious 'webSocketSelfURI' and 'page_title' query parameters. These values are persisted in an in-memory SQLite table and broadcast to all connected clients. On the client side, 'script.js' interpolates the 'page_title' into an HTML template literal and passes it to the jQuery '.append()' sink without sanitization. If an administrator is viewing a page with the YPTSocket debug panel enabled, the injected script executes in their authenticated context, enabling session hijacking and full site takeover. This issue is patched in version 29.0.

## Affected products

- WWBN AVideo Prior to 29.0

## Identifiers

- CVE-2026-54458
- GHSA-8whc-2wmv-ww35

## Timeline

- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date

## References

- [https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16](https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16)
- [https://github.com/WWBN/AVideo/security/advisories/GHSA-8whc-2wmv-ww35](https://github.com/WWBN/AVideo/security/advisories/GHSA-8whc-2wmv-ww35)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)