{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"29.0"}],"component":"WWBN/AVideo","cve_ids":["CVE-2026-54458"],"ecosystem":"Packagist","epss":0.00382,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-8whc-2wmv-ww35","id":"tcs_01M5KEZDY5G23Z4YWJ1RXCJKVF","modified_at":"2026-09-10T03:50:49.025782580Z","published_at":"2026-06-04T18:57:50Z","references":["https://osv.dev/vulnerability/GHSA-8whc-2wmv-ww35","https://github.com/WWBN/AVideo/security/advisories/GHSA-8whc-2wmv-ww35","https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16","https://github.com/WWBN/AVideo"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-8whc-2wmv-ww35","url":"https://osv.dev/vulnerability/GHSA-8whc-2wmv-ww35"}],"summary":"WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin"}