CVE-2026-89249
Received Received - Intake

Stored XSS in AVideo YPTWallet Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in wallet_log.information. Administrators viewing pending withdrawal requests in pendingRequests.php execute the stored markup in their session, allowing attackers to perform administrative actions via same-origin fetch requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89249
EUVD
EUVD-2026-76061

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
avideo yptwallet *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the AVideo software's YPTWallet plugin. User-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage. When administrators view pending withdrawal requests, the stored malicious payload executes in their session, allowing attackers to perform unauthorized actions.

Detection Guidance

Check for suspicious wallet_log.information entries in the database containing base64-encoded XSS payloads like <img src=x onerror=...>. Review pendingRequests.php page source for unescaped HTML execution. Monitor admin session activity for unexpected administrative actions.

Impact Analysis

Attackers can execute arbitrary JavaScript in admin sessions, potentially performing administrative actions like same-origin requests. This could lead to unauthorized data access, modifications, or system control. The impact depends on admin privileges and system configuration.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or modification. GDPR may be impacted if personal data is exposed, while HIPAA could be affected if protected health information is compromised. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Disable the YPTWallet plugin if not in use. Update to the latest commit beyond c3edcc274c389816d434acadac07ee78eaf330c1. Sanitize CryptoWallet input by HTML-escaping before storage. Remove malicious wallet_log.information entries from the database.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89249. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart