CVE-2026-34716 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a stored XSS caused by unsanitized caller display name rendered via jQuery Toast Plugin in YPTSocket plugin, letting attackers execute scripts on online users' browsers via calls, exploit requires victim to be connected to WebSocket.

Severity & Score

Impact

Attackers can execute arbitrary scripts in online users' browsers, potentially stealing data or performing actions on their behalf.

Mitigation

Update to the latest version when patches become available or apply input sanitization to caller display names.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-w4hp-w536-jg64

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner