Executive brief
WWBN AVideo is a video streaming and hosting platform. The application stores user-provided URLs in a donation link profile field without proper validation or encoding. An authenticated attacker can inject malicious JavaScript into their donation link, which then executes in the browsers of any visitor—including administrators—who view the attacker's videos and interact with the donation button, potentially leading to account compromise or malware distribution.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the user donation link feature. The vulnerability exists in the User::setDonationLink() method in objects/user.php, which validates input only with filter_var(..., FILTER_VALIDATE_URL)—a check that accepts malicious payloads like http://evil.example/"onmouseover=alert(document.domain)//. The getDonationLink() method applies only strip_tags() without encoding double quotes. The unencoded value is then echoed directly into an href attribute in plugin/CustomizeUser/actionButton.php, which is rendered on every watch page when the CustomizeUser plugin's allowDonationLink option is enabled. An authenticated user can update their profile via objects/userUpdate.json.php to inject the payload. When any visitor (including administrators) hovers over or interacts with the donation button, the injected JavaScript executes in their browser with full page privileges. The issue was unfixed at the time of public disclosure.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory GHSA-34jx-r3p9-7pp2 published
- 2026-09-11: advisory: CVE-2026-89253 published on NVD