GHSA-8whc-2wmv-ww35

# Unauthenticated Stored DOM XSS via `page_title` Broadcast in AVideo YPTSocket Plugin ## Summary A stored DOM Cross-Site Scripting vulnerability (CWE-79) in the AVideo YPTSocket plugin lets any unauthenticated remote attacker execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. `plugin/YPTSocket/getWebSocket.json.php` issues a signed WebSocket token to any anonymous caller, and `MessageSQLiteV2::onOpen` at `plugin/YPTSocket/MessageSQLiteV2.php` lines 91 and 110 reads the attacker-controlled `webSocketSelfURI` and `page_title` query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite `connections` table and broadcast inside the `users_id_online` array sent to every connected client; on the client, `plugin/YPTSocket/script.js::updateSocketUserCard` interpolates the broadcast `page_title` into an HTML template literal that is passed to jQuery `$.append(html)`, which parses attacker bytes into live DOM nodes including `<img>` with inline event handlers. ## Details `plugin/YPTSocket/getWebSocket.json.php` issues a WebSocket token to any caller; the only gate is `AVideoPlugin::isEnabledByName("YPTSocket")`. The token-issuance helper `getEncryptedInfo()` at `plugin/YPTSocket/functions.php:21-24` writes `$_REQUEST['webSocketSelfURI']` directly into the per-token state without validation: ```php // plugin/YPTSocket/functions.php:21-24 if (!empty($_REQUEST['webSocketSelfURI'])) { $msgObj->selfURI = $_REQUEST['webSocketSelfURI']; } else { $msgObj->selfURI = getSelfURI(); } ``` On WebSocket open, `MessageSQLiteV2::onOpen` reads `webSocketSelfURI` and `page_title` from the connection URL query string and persists both verbatim into the in-memory SQLite `connections` table: ```php // plugin/YPTSocket/MessageSQLiteV2.php:91 and :110 $client['selfURI'] = $wsocketGetVars['webSocketSelfURI']; // l