CVE-2026-89253 WWBN CVE debrief

Who should care

Defenders responsible for WWBN AVideo installations should assess exposure and prioritize verification and updates to prevent exploitation. This includes reviewing system configurations, ensuring that the 'donationLink' profile field is properly restricted, and implementing additional security measures such as encoding user input and validating URLs. Security teams should also monitor for potential exploitation attempts and review relevant logs for exposed

Why it matters

A stored cross-site scripting vulnerability in WWBN AVideo allows an authenticated user to inject malicious JavaScript code, potentially leading to execution of arbitrary code, phishing, or further exploitation. Defenders should prioritize verifying and updating AVideo installations to prevent exploitation.

• Execution of arbitrary JavaScript code in the browser of visitors who interact with the donation button
• Potential for phishing or further exploitation through injected JavaScript
• Elevation of privileges through exploitation by an authenticated user
• Possible impact on the confidentiality and integrity of user data

Technical summary

The vulnerability exists in the user 'donationLink' profile field of WWBN AVideo. An authenticated user can inject malicious JavaScript code, which can be executed in the browser of any visitor who views the attacker's videos and interacts with the donation button. The issue arises from inadequate validation and encoding of user input in the 'donationLink' profile field. Specifically, the setDonationLink() function in objects/user.php only validates the input using filter_var() with FILTER_VALIDATE_URL, which can be bypassed with malicious URLs. The getDonationLink() function applies only strip_tags() and does not encode double quotes, allowing for JavaScript injection.

Defensive priority

Defenders should prioritize verifying and updating AVideo installations to prevent exploitation.

Recommended defensive actions

• Verify AVideo installations for vulnerability and update to a fixed version if available
• Restrict user input in the 'donationLink' profile field to prevent JavaScript injection
• Implement additional security measures, such as encoding user input and validating URLs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by inadequate validation and encoding of user input in the 'donationLink' profile field. The setDonationLink() function in objects/user.php only validates the input using filter_var() with FILTER_VALIDATE_URL, which can be bypassed with malicious URLs. The getDonationLink() function applies only strip_tags() and does not encode double quotes, allowing for JavaScript injection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.