Changes.Watch~ upgrade verdicts ~
Free digest
Research1 in 10 popular npm releases needed a hotfix

critical vulnerability

WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

Fix availableCritical · CVSS 9.6EPSS 0.38%

Published Jun 4, 2026 · updated Oct 29, 2026

What to do

  1. Upgrade to a fixed version: WWBN/AVideo 29.1.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

ComposerWWBN/AVideo

Vulnerable versions
< 29.1.0
Fixed in
29.1.0

Check your project: composer show WWBN/AVideo

Sources

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

← All critical vulnerabilities