← Back to the live CVE advisory feed

CVE-2026-89253: AVideo

Severity

9.3 (CRITICAL)

Vendor

WWBN

Affected versions

0 through c3edcc274c389816d434acadac07ee78eaf330c1

Patch status

Unknown

Published

2026-09-11T12:16:55.533

Modified

2026-09-11T15:21:12.850

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() (objects/user.php) stores the value and save() validates it only with filter_var(…, FILTER_VALIDATE_URL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only strip_tags() and does not encode double quotes. plugin/CustomizeUser/actionButton.php echoes the value unencoded into an attribute, and that button is included from view/modeYoutubeBottom.php on the watch page when the CustomizeUser option allowDonationLink is enabled. An authenticated user who updates their own profile via objects/userUpdate.json.php can therefore break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor—including an administrator—who views the attacker's videos and interacts with (for example, hovers over) the donation button. The issue was unfixed at the time of reporting.

View the official NVD record for CVE-2026-89253

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.