CVE-2026-89253

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting (XSS) flaw in the user 'donationLink' profile field. An authenticated user can set a crafted URL via objects/userUpdate.json.php because the saved value is validated only with FILTER_VALIDATE_URL (which accepts strings like http://evil.example/"onmouseover=alert(document.domain)//) and is later output with only strip_tags() and no quote encoding. The value is echoed unencoded into an href attribute in plugin/CustomizeUser/actionButton.php, which is included from view/modeYoutubeBottom.php on the watch page when the CustomizeUser 'allowDonationLink' option is enabled, so a visitor who hovers over the donation button on the attacker's video pages triggers the injected JavaScript. An attacker gains script execution in the browser of any visitor, including administrators, enabling actions such as stealing session cookies or performing privileged actions in the context of the victim. All AVideo deployments running code up to and including the named commit with the donation-link feature enabled are affected; the issue was unfixed at the time of reporting, with no known public proof-of-concept or reported in-the-wild exploitation.

What to do: No patched version was available at the time of reporting, so monitor the AVideo repository for a fix and upgrade beyond commit c3edcc274c389816d434acadac07ee78eaf330c1 once a patch is released. As an interim mitigation, disable the 'allowDonationLink' option in the CustomizeUser plugin (or restrict which users may set donationLink values), and audit existing user profiles for donationLink values containing quotes or event-handler text.