WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
Date: 2026-06
Affected: composer/WWBN/AVideo
Attack vector: xss
Category: vulnerability-disclosure
Severity: Critical
CWE: CWE-79
CVSS: 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L)

# Unauthenticated Stored DOM XSS via `page_title` Broadcast in AVideo YPTSocket Plugin ## Summary A stored DOM Cross-Site Scripting vulnerability (CWE-79) in the AVideo YPTSocket plugin lets any unauthenticated remote attacker execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. `plugin/YPTSocket/getWebSocket.json.php` issues a signed WebSocket token to any anonymous caller, and `MessageSQLiteV2::onOpen` at `plugin/YPTSocket/MessageSQLiteV2.php` lines 91 and 110 reads the attacker-controlled `webSocketSelfURI` and `page_title` query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite `connections` table and broadcast inside the `users_id_online` array sent to every connected client; on the client, `plugin/YPTSocket/script.js::updateSocketUserCard` interpolates the broadcast `page_title` into an HTML template literal that is passed to jQuery `$.append(html)`, which parses attacker bytes into live DOM nodes including `<img>` with inline event handlers. ## Details `plugin/YPTSocket/getWebSocket.json.php` issues a WebSocket token to any caller; the only gate is `AVideoPlugin::isEnabledByName("YPTSocket")`. The token-issuance helper `getEncryptedInfo()` at `plugin/YPTSocket/functions.php:21-24` writes `$_REQUEST['webSocketSelfURI']` directly into the per-token state without validation: ```php // plugin/YPTSocket/fu


Mitigations:

Architectural layers (MAESTRO):