WWBN AVideo unauthenticated stored DOM XSS in YPTSocket plugin

Executive brief

A security vulnerability in the AVideo video sharing platform allows an unauthenticated attacker to take over administrator accounts. By sending a malicious message through the platform's real-time communication system (YPTSocket), an attacker can execute unauthorized commands in the browser of any administrator currently logged into the site. This can lead to full administrative control of the video platform, data theft, and unauthorized site modifications.

Technical details

A stored DOM XSS vulnerability exists in the AVideo YPTSocket plugin due to insufficient validation of WebSocket connection parameters. An unauthenticated attacker can obtain a WebSocket token via 'getWebSocket.json.php' and connect to the WebSocket server with a malicious 'page_title' query parameter. This value is persisted in an in-memory SQLite table and broadcast to all connected clients. On the client side, 'script.js' interpolates this unescaped value into an HTML template literal and passes it to the jQuery '.append()' sink. If an administrator is viewing a page with the YPTSocket debug panel enabled (default), the attacker's JavaScript executes in their session context, enabling account takeover and data exfiltration.

Affected products

• WWBN AVideo <= 29.0

Timeline

• 2026-06-04: advisory: GitHub Advisory GHSA-8whc-2wmv-ww35 published
• 2026-06-04: patched: Fix committed in 8be71e53ccbe9b84b30870db386fb4d2b11e1c16

References

• https://api.github.com/users/arkmarta
• https://github.com/arkmarta
• https://api.github.com/users/arkmarta/gists%7B/gist_id%7D
• https://api.github.com/users/arkmarta/repos
• https://avatars.githubusercontent.com/u/248169372?v=4
• https://api.github.com/users/arkmarta/events%7B/privacy%7D