AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability

Published September 11, 2026 CVE-2026-89249

AVideo's YPTWallet plugin lets any logged-in user hide script code inside a cryptocurrency withdrawal request. When an administrator opens that request to review it, the hidden code runs inside the administrator's own logged-in session and can carry out admin actions on their behalf.

Severity
HighCVSS 3.1 · 8.7 · vulncheck.com
Fix
Release fix not confirmedSource revisions listed; check the advisory
Weakness
CWE-79Cross-site Scripting (XSS)
Affects
AVideo
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: partial
EU ID
EUVD-2026-76061ENISA vulnerability database

How it works

  • A logged-in AVideo user who has a wallet balance submits a cryptocurrency wallet value through the YPTWallet plugin's configuration option.
  • AVideo encodes that value with base64 but never strips or escapes HTML and script markup from it.
  • The value is later decoded and written into the wallet_log.information field attached to a withdrawal request.
  • When an administrator opens the pending withdrawal requests page, AVideo displays that stored value as raw HTML instead of plain text, so any script hidden inside it runs inside the administrator's browser and can send requests to the site as the administrator.

What to do

If you run WWBN/AVideo with the YPTWallet plugin enabled at commit c3edcc274c389816d434acadac07ee78eaf330c1 or earlier, compare your deployed commit against the GHSA-fvp5-q9jp-29mx advisory to see whether you fall in the affected range. Check whether YPTWallet is enabled and whether users can submit withdrawal requests on your site, since the flaw only triggers through that feature. Open the pending withdrawal requests and history pages as an administrator and look at the stored information field for any HTML or script markup instead of a plain wallet address.

Watch the GHSA-fvp5-q9jp-29mx advisory for a patched release, since WWBN had not shipped a fix as of the report. Review existing pending withdrawal and history log entries in YPTWallet for HTML or script content in the wallet information field, since that indicates a planted stored script rather than a real address.

Technical details

CVE-2026-89249 is a stored XSS in AVideo's YPTWallet plugin. Wallet::setCrypto_wallet_address base64-encodes the CryptoWallet POST value but never runs it through htmlspecialchars. manualWithdrawFunds.json.php later decodes that value and concatenates it into the $emailMessage string that WalletLog::addLog stores in wallet_log.information. pendingRequests.php's bootgrid formatter renders row.information as HTML rather than as text, so markup in the stored value executes in the administrator's browser when the pending requests page (or history.php) is opened, allowing same-origin fetch requests as the administrator. Exploitation requires a logged-in account able to complete a manual withdrawal and requires YPTWallet enabled.

CVSS 3.1 scores it 8.7 high; NVD lists a CVSS 4.0 score of 9.3 critical. No fixed version was available at time of reporting.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction Required Requires another user to take an action
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source