CVE-2026-89249 WWBN CVE debrief

Who should care

Defenders managing AVideo installations, especially those with administrative access to pending withdrawal requests, should assess exposure and prioritize remediation. Additionally, security teams and vulnerability management teams should review the vulnerability and implement measures to prevent exploitation. Operators of AVideo installations should also review the vulnerability and take steps to mitigate it. This includes reviewing and limiting access to

Why it matters

This stored cross-site scripting vulnerability in AVideo's YPTWallet plugin allows attackers to perform administrative actions when administrators view pending withdrawal requests. Defenders should prioritize verifying and remediating this vulnerability, especially those managing AVideo installations and administrators who view pending withdrawal requests.

• Potential for attackers to perform administrative actions via same-origin fetch requests
• Risk of unauthorized access to sensitive information and functionality
• Need for defenders to verify and remediate this vulnerability
• Importance of implementing HTML escaping for user-supplied input

Technical summary

The AVideo YPTWallet plugin stores user-supplied CryptoWallet values in a base64-encoded but not HTML-escaped format. When administrators view pending withdrawal requests, the stored markup is executed in their session, allowing attackers to perform administrative actions via same-origin fetch requests. This vulnerability is critical because it allows attackers to execute arbitrary code in the context of an administrator's session, potentially leading to unauthorized access to sensitive information and functionality. The vulnerability is caused by the lack of HTML escaping for user-supplied input, which allows attackers to inject malicious code.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially those managing AVideo installations and administrators who view pending withdrawal requests.

Recommended defensive actions

• Verify AVideo installations for the YPTWallet plugin and assess exposure
• Review and limit administrative access to pending withdrawal requests
• Implement HTML escaping for user-supplied CryptoWallet values
• Monitor for suspicious same-origin fetch requests
• Track exceptions and retest remediated assets
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the stored cross-site scripting vulnerability in AVideo's YPTWallet plugin. However, further information on affected versions, exploitation, and remediation is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.