CVE-2026-54458: WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 0.5%, percentile 42: FIRST’s model estimates a 0.5% chance of exploitation activity in the next 30 days, higher than 42% of all scored CVEs (low). EPSS is a probability, not a verdict.
• Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.
• Only applies if your dependency tree includes WWBN/AVideo (Composer (PHP)) <= 29.0, no fixed version listed. Check your lockfile, including transitive dependencies.

What it is

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugin/YPTSocket/MessageSQLiteV2.php lines 91 and 110 reads the attacker-controlled webSocketSelfURI and pagetitle query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite connections table and broadcast inside the usersidonline array sent to every connected client; on the client, plugin/YPTSocket/script.js::updateSocketUserCard interpolates the broadcast pagetitle into an HTML template literal that is passed to jQuery $.append(html), which parses attacker bytes into live DOM nodes including with inline event handlers. Successful attackers can can read non-HttpOnly cookies and the CSRF token rendered into the admin dashboard, issue authenticated requests to any admin-only endpoint, exfiltrate the admin dashboard DOM, and chain into any admin-context mutation. When the victim is an AVideo administrator, the attacker turns a single anonymous WebSocket connection into full administrative takeover via the admin's own session. This issue has been patched by https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16.

From the GitHub advisory

Unauthenticated Stored DOM XSS via pagetitle Broadcast in AVideo YPTSocket Plugin

Summary

A stored DOM Cross-Site Scripting vulnerability (CWE-79) in the AVideo YPTSocket plugin lets any unauthenticated remote attacker execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugin/YPTSocket/MessageSQLiteV2.php lines 91 and 110 reads the attacker-controlled webSocketSelfURI and pagetitle query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite connections table and broadcast inside the usersidonline array sent to every connected client; on the client, plugin/YPTSocket/script.js::updateSocketUserCard interpolates the broadcast pagetitle into an HTML template literal that is passed to jQuery $.append(html), which parses attacker bytes into live DOM nodes including with inline event handlers.

Details

plugin/YPTSocket/getWebSocket.json.php issues a WebSocket token to any caller; the only gate is AVideoPlugin::isEnabledByName("YPTSocket"). The token-issuance helper getEncryptedInfo() at plugin/YPTSocket/functions.php:21-24 writes $REQUEST['webSocketSelfURI'] directly into the per-token state without validation:

Weakness type: CWE-79.

Product: WWBN/AVideo (Composer (PHP)) · Assigned by: GitHub_M · Published: 2026-07-15

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Privileges required: none (no login)
• User interaction: required (a user must click/open something)
• Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 0.51% probability of exploitation activity in the next 30 days; percentile 42.

Timeline

• 2026-06-04 — GitHub-reviewed advisory GHSA-8whc-2wmv-ww35 published (critical)
• 2026-07-15 — CVE record published by GitHub_M
• 2026-07-16 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-8whc-2wmv-ww35 github.com
2. CVE.org record CVE-2026-54458 cve.org
3. NVD entry CVE-2026-54458 nvd.nist.gov

Other references from the CVE record and advisory

1. github.com github.com
2. github.com github.com

Critical Composer (PHP) advisories · Today’s Security Digest