CVE-2026-89253 WWBN CVE debrief

Who should care

Defenders responsible for AVideo installations, especially those with user profile customization enabled, should assess the risk of this vulnerability and prioritize verification of exposure and remediation.

Why it matters

A stored cross-site scripting vulnerability in WWBN AVideo's user 'donationLink' profile field allows for potential JavaScript injection and execution in browsers of visitors, including administrators, who view the attacker's videos and interact with the donation button. Defenders should prioritize verifying exposure of AVideo installations to this vulnerability, especially if user profile customization is enabled, and assess the risk of JavaScript injection via user-controlled donation links. The vulnerability requires verification from official sources for affected versions, exploitation, impact, and remediation.

• Potential for JavaScript injection and execution in browsers of visitors, including administrators.
• Risk of unauthorized actions or data exposure through injected JavaScript.
• Need for verification of AVideo installations for exposure to this vulnerability.
• Priority for restricting user input in the donation link field to prevent JavaScript injection.

Technical summary

The vulnerability exists in the user 'donationLink' profile field of WWBN AVideo. An authenticated user can inject JavaScript into this field, which is then echoed unencoded into an <a href> attribute on the watch page. This potentially allows attackers to execute JavaScript in the browser of any visitor, including administrators, who views the attacker's videos and interacts with the donation button.

Defensive priority

Defenders should prioritize verifying exposure of AVideo installations to this vulnerability, especially if user profile customization is enabled, and assess the risk of JavaScript injection via user-controlled donation links.

Recommended defensive actions

• Verify AVideo installations for exposure to this vulnerability, especially if user profile customization is enabled.
• Assess the risk of JavaScript injection via user-controlled donation links.
• Restrict user input in the donation link field to prevent JavaScript injection.
• Encode user-controlled input in the donation link field when displayed on the watch page.
• Monitor for potential JavaScript injection attempts via user donation links.

Evidence notes

The CVE record and source references provide details on the vulnerability, including its existence in AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1, the affected component (user 'donationLink' profile field), and the potential impact of JavaScript injection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.