WWBN AVideo versions 26.0 and prior contain an XSS vulnerability in the YPTSocket plugin's caller feature. The plugin uses the jQuery Toast Plugin to render incoming call notifications, inserting the caller's display name directly into the DOM as raw HTML via jQuery's .html() method. This allows an attacker to inject arbitrary HTML or script code by setting their display name to a malicious payload. When the attacker initiates a call, the payload executes in the browsers of all online users connected to the WebSocket, requiring no user interaction beyond being connected. There are no publicly available patches or fixes at the time of this report.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers connected to the AVideo platform. This can lead to theft of session tokens, user impersonation, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS score of 6.4 reflects a medium severity with network attack vector, low attack complexity, and no user interaction required.

At the time of publication, no official patches or fixes are available for this vulnerability. Users of WWBN AVideo should monitor the vendor's advisories for updates. As a temporary mitigation, administrators may consider disabling or restricting the YPTSocket plugin's caller feature or filtering/sanitizing user display names before they are rendered. Avoid exposing the vulnerable functionality to untrusted users until an official fix is released.