---
id: CVE-2026-89249
title: AVideo YPTWallet Stored XSS via CryptoWallet Configuration
summary: >-
  AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a
  stored cross-site scripting vulnerability in the YPTWallet plugin where
  user-supplied CryptoWallet values are base64-encoded but not HTML-escaped
  before storage in…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: WWBN
product: AVideo
affected:
  - AVideo <= c3edcc274c389816d434acadac07ee78eaf330c1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-11T17:43:26.405308Z'
published: '2026-09-11'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T20:29:58.576Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89249'
references:
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-fvp5-q9jp-29mx'
    label: GitHub Security Advisory (GHSA-fvp5-q9jp-29mx)
  - url: >-
      https://www.vulncheck.com/advisories/avideo-yptwallet-stored-xss-via-cryptowallet-configuration
    label: >-
      VulnCheck Advisory: AVideo YPTWallet Stored XSS via CryptoWallet
      Configuration
tags:
  - cve.org
epss: 0.00367
epssPercentile: 0.27825
ingestedAt: '2026-09-14T11:11:19.882Z'
---

## Overview

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in wallet_log.information. Administrators viewing pending withdrawal requests in pendingRequests.php execute the stored markup in their session, allowing attackers to perform administrative actions via same-origin fetch requests.

## Affected

- `AVideo <= c3edcc274c389816d434acadac07ee78eaf330c1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.