CVE-2026-89249: AVideo YPTWallet Stored XSS via CryptoWallet Configuration
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in walletlog.information. Administrators viewing pending withdrawal requests in pendingRequests.php execute the stored markup in their session, allowing attackers to perform administrative actions via same-origin fetch requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideo YPTWallet pluginto a version that resolves this vulnerability.Patch c3edcc274c389816d434acadac07ee78eaf330c1 - Configuration
Modify the YPTWallet plugin so that user-supplied CryptoWallet values are HTML-escaped before being stored in wallet_log.information (the stored XSS occurs because the values are base64-encoded but not HTML-escaped before storage).
AVideo YPTWallet plugin (wallet_log.information) HTML escaping of user-supplied CryptoWallet values before storage = HTML-escape base64-decoded CryptoWallet values - Compensating control
Restrict or limit access to the pending withdrawal request administration page (pendingRequests.php) to authorized administrators to reduce the ability for an attacker to leverage the stored XSS via administrator sessions.
Event History
Frequently Asked Questions
Who can trigger the vulnerability, and who is impacted when it is exploited?
A user who can submit a withdrawal request with a CryptoWallet value can store the malicious markup. The payload executes when an administrator views pending withdrawal requests, exposing that administrator's authenticated session to same-origin actions.
Does base64 encoding of the CryptoWallet value prevent exploitation?
No. The CryptoWallet value is base64-encoded but is not HTML-escaped before being stored in wallet_log.information, allowing stored markup to execute when rendered in the pending withdrawal request view.
What attacker interaction is required for exploitation?
The attacker needs to submit a crafted CryptoWallet value in a withdrawal request. An administrator must then view the request in pendingRequests.php for the stored payload to execute.
What can an attacker do after the payload runs in an administrator's session?
The vulnerability allows the attacker to perform administrative actions through same-origin fetch requests made in the administrator's authenticated browser session.