CVE-2026-34716

Descripción

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo YPTSocket plugin-s caller feature renders incoming call notifications using the jQuery Toast Plugin, passing the caller-s display name directly as the heading parameter. The toast plugin constructs the heading as raw HTML (-<h2>- + heading + -</h2>-) and inserts it into the DOM via jQuery-s .html() method, which parses and executes any embedded HTML or script content. An attacker can set their display name to an XSS payload and trigger code execution on any online user-s browser simply by initiating a call - no victim interaction is required beyond being connected to the WebSocket. At time of publication, there are no publicly available patches.