Executive brief
AVideo is a video hosting and streaming platform. The CustomizeUser plugin, enabled by default, contains a stored cross-site scripting (XSS) vulnerability where user-supplied data is saved to a database without sanitization and later displayed unsanitized in web pages. An administrator can inject malicious JavaScript that executes in the browsers of other users viewing extra info pages or registration/profile forms, potentially stealing sessions, data, or performing actions on their behalf.
Technical details
The vulnerability exists in plugin/CustomizeUser/View/Users_extra_info/add.json.php and the CustomizeUser plugin's extra-info functionality. The field_name parameter submitted via POST is stored raw into the database without sanitization via Users_extra_info::setField_name(). The stored value is later interpolated unsanitized by the typeToHTML() function into HTML label text and placeholder attributes, and echoed directly in extraInfo.php. An attacker with administrator privileges (or via CSRF with same-origin Referer) can inject HTML/JavaScript that executes in the context of the AVideo application when viewed by administrators or users on extra info and profile pages. The endpoint does not call isGlobalTokenValid(), unlike similar endpoints. Patches were not available at the time of the advisory publication.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed: GitHub security advisory GHSA-7hj4-f9x4-gg7p published
- 2026-09-11: advisory: CVE-2026-89254 published