CVE-2026-89253
Received Received - Intake

Stored XSS in AVideo User Profile Donation Link

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() (objects/user.php) stores the value and save() validates it only with filter_var(..., FILTER_VALIDATE_URL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only strip_tags() and does not encode double quotes. plugin/CustomizeUser/actionButton.php echoes the value unencoded into an <a href="..."> attribute, and that button is included from view/modeYoutubeBottom.php on the watch page when the CustomizeUser option allowDonationLink is enabled. An authenticated user who updates their own profile via objects/userUpdate.json.php can therefore break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor—including an administrator—who views the attacker's videos and interacts with (for example, hovers over) the donation button. The issue was unfixed at the time of reporting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89253
EUVD
EUVD-2026-76065

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in AVideo, a video-sharing platform. It occurs in the user profile field 'donationLink' where improper input validation allows malicious JavaScript injection. The flaw happens because the donation link is stored without proper sanitization, accepted by a weak URL validation filter, and later rendered unencoded in an HTML attribute on the watch page. An authenticated attacker can exploit this by updating their profile with a crafted donation link containing an event handler like onmouseover, which executes arbitrary JavaScript when other users hover over the donation button on the attacker's videos.

The issue arises because the setDonationLink() function stores input after validating it with filter_var(..., FILTER_VALIDATE_URL), which incorrectly accepts malicious URLs. The getDonationLink() function only applies strip_tags(), not encoding double quotes, allowing them to break out of the href attribute in HTML output.

Detection Guidance

To detect this vulnerability, inspect AVideo installations for versions up to commit c3edcc274c389816d434acadac07ee78eaf330c1. Check user profiles for donation links containing event handlers like onmouseover or other JavaScript events. Review the watch page HTML for unencoded double quotes in href attributes.

Impact Analysis

An attacker with a valid login can exploit this to inject malicious scripts into profiles. When other users, including administrators, view the attacker's videos and hover over the donation button, the injected script executes in their browsers. This could lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the victim.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. If exploited, it may result in data breaches, unauthorized data processing, or loss of user trust, potentially leading to regulatory fines or legal consequences.

Mitigation Strategies

Immediately update AVideo to the latest version beyond commit c3edcc274c389816d434acadac07ee78eaf330c1. Disable the donationLink feature in user profiles if not required. Implement strict input validation for donation links, rejecting any input containing quotes or JavaScript event handlers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart