---
id: CVE-2026-89253
title: >-
  WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a
  stored cross-site scripting vulnerability in the user 'donationLink' profile
  field
summary: >-
  WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a
  stored cross-site scripting vulnerability in the user 'donationLink' profile
  field. User::setDonationLink() (objects/user.php) stores the value and save()
  val…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
vendor: WWBN
product: AVideo
affected:
  - AVideo <= c3edcc274c389816d434acadac07ee78eaf330c1
published: '2026-09-11'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T15:21:12.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89253'
references:
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-34jx-r3p9-7pp2'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/avideo-stored-xss-via-donationlink-in-watch-page-button
    label: disclosure@vulncheck.com
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-34jx-r3p9-7pp2'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-11T12:23:54.076681Z'
ingestedAt: '2026-09-11T16:45:47.861Z'
epss: 0.00347
epssPercentile: 0.28324
---

## Overview

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() (objects/user.php) stores the value and save() validates it only with filter_var(..., FILTER_VALIDATE_URL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only strip_tags() and does not encode double quotes. plugin/CustomizeUser/actionButton.php echoes the value unencoded into an <a href="..."> attribute, and that button is included from view/modeYoutubeBottom.php on the watch page when the CustomizeUser option allowDonationLink is enabled. An authenticated user who updates their own profile via objects/userUpdate.json.php can therefore break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor—including an administrator—who views the attacker's videos and interacts with (for example, hovers over) the donation button. The issue was unfixed at the time of reporting.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.