An unauthenticated cross-site scripting vulnerability in the WWBN AVideo YPTSocket plugin allows remote attackers to execute arbitrary JavaScript, posing a significant risk to user session integrity.

This vulnerability is a cross-site scripting (CWE-79) flaw triggered via the websocket callback mechanism. Unauthenticated attackers can inject malicious payloads into global functions like avideoConfirmHTML, which subsequently assigns the untrusted data to innerHTML, resulting in script execution within the victim's origin.

The ability for an unauthenticated attacker to execute arbitrary scripts in the browsers of other users, including potentially administrative accounts, can lead to full session hijacking, unauthorized actions performed on behalf of the user, and the theft of sensitive session cookies. Given the CVSS score of 7.2, this high-severity vulnerability represents a significant threat to the confidentiality and integrity of the AVideo platform and its user data.

Immediate Action: Review the official security advisory at the GitHub repository linked in the references to identify available patches or recommended configuration changes. If a patch is not yet available, consider disabling the YPTSocket plugin until a secure version is released.

Proactive Monitoring: Monitor server access logs for anomalous websocket traffic and investigate requests containing unexpected callback names or suspicious JavaScript patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect websocket traffic for common cross-site scripting patterns and block requests that attempt to invoke sensitive global functions with malicious payloads.

Public Exploit Available: Unknown

This vulnerability presents a high risk due to the ease with which an unauthenticated attacker can compromise user sessions. IT administrators must prioritize the review of the vendor's security advisory and apply any provided updates immediately. If the YPTSocket plugin is not essential for business operations, it should be disabled as a primary security measure until an official fix can be verified and deployed.