{"id":"CVE-2026-89249","title":"AVideo YPTWallet Stored XSS via CryptoWallet Configuration","summary":"AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in…","severity":"high","cvss":8.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"WWBN","product":"AVideo","affected":["AVideo <= c3edcc274c389816d434acadac07ee78eaf330c1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-11T17:43:26.405308Z"},"published":"2026-09-11","updated":"2026-09-11","sourceUpdated":"2026-09-11T20:29:58.576Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89249","references":[{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-fvp5-q9jp-29mx","label":"GitHub Security Advisory (GHSA-fvp5-q9jp-29mx)"},{"url":"https://www.vulncheck.com/advisories/avideo-yptwallet-stored-xss-via-cryptowallet-configuration","label":"VulnCheck Advisory: AVideo YPTWallet Stored XSS via CryptoWallet Configuration"}],"tags":["cve.org"],"epss":0.00279,"epssPercentile":0.20561,"ingestedAt":"2026-09-14T11:11:19.882Z","slug":"CVE-2026-89249","body":"## Overview\n\nAVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in wallet_log.information. Administrators viewing pending withdrawal requests in pendingRequests.php execute the stored markup in their session, allowing attackers to perform administrative actions via same-origin fetch requests.\n\n## Affected\n\n- `AVideo <= c3edcc274c389816d434acadac07ee78eaf330c1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}