CVE-2026-89253

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink() (objects/user.php) stores the value and save() validates it only with filter_var(..., FILTER_VALIDATE_URL), which accepts strings such as http://evil.example/"onmouseover=alert(document.domain)//, while getDonationLink() applies only strip_tags() and does not encode double quotes. plugin/CustomizeUser/actionButton.php echoes the value unencoded into an <a href="..."> attribute, and that button is included from view/modeYoutubeBottom.php on the watch page when the CustomizeUser option allowDonationLink is enabled. An authenticated user who updates their own profile via objects/userUpdate.json.php can therefore break out of the href attribute and inject an event handler that executes JavaScript in the browser of any visitor—including an administrator—who views the attacker's videos and interacts with (for example, hovers over) the donation button. The issue was unfixed at the time of reporting.

• CWE-79

• https://github.com/WWBN/AVideo/security/advisories/GHSA-34jx-r3p9-7pp2
• https://www.vulncheck.com/advisories/avideo-stored-xss-via-donationlink-in-watch-page-button
• https://github.com/WWBN/AVideo/security/advisories/GHSA-34jx-r3p9-7pp2

Published

Sep 11, 2026

Last Modified

Sep 11, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89248AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…5.3
• CVE-2026-89249AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
• CVE-2026-8925The curl logic that works with SASL authentication could end…9.8
• CVE-2026-89250WWBN AVideo through commit c3edcc274c389816d434acadac07ee78e…7.5
• CVE-2026-89251AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…6.5
• CVE-2026-89252AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…6.5
• CVE-2026-89254AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
• CVE-2026-89255AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
• CVE-2026-89256AVideo through commit c3edcc274c389816d434acadac07ee78eaf330…8.7
• CVE-2026-89257AVideo through 29.0 contains an insecure direct object refer…5.4
• CVE-2026-89258Hugo is a static site generator. In versions after v0.123.0 …6.3
• CVE-2026-89259Hugo is a static site generator. From v0.161.0, Hugo execute…9.8