AVideo CVE-2026-89249

Requires an authenticated low-privilege account (PR:L) able to set a CryptoWallet value in the YPTWallet plugin, and the YPTWallet plugin must be enabled/in use on the AVideo instance. Exploitation is gated on administrator interaction (UI:P): an admin must view the attacker's pending withdrawal request in pendingRequests.php for the stored payload to fire. Limiting factors: the payload only executes in the admin withdrawal-review context, so instances not using YPTWallet withdrawals, or where withdrawal requests are never reviewed in-browser, are not exposed.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N, score 9.3) reflects a network-reachable, low-complexity attack that nonetheless requires attacker privileges (PR:L - a wallet-configuring account) and victim interaction (UI:P - an admin must open the pending-requests page). The high subsequent-system impact (SC:H/SI:H) captures the privilege escalation to admin actions via the injected script. No EPSS score, KEV listing, or public POC was provided; this is not confirmed as actively exploited and no public exploit was identified at time of analysis. Realistically this is a genuine but conditional risk: it is a targeted stored-XSS-to-admin-takeover chain gated on obtaining a low-priv account and on an administrator viewing the malicious withdrawal request, not a mass-exploitable unauthenticated flaw. The 9.3 is defensible given the admin-takeover outcome but the PR:L and UI:P conditions meaningfully limit spray-and-pray exploitation.

An attacker registers or uses a low-privilege AVideo account, opens the YPTWallet configuration, and enters a CryptoWallet value containing an HTML/script payload, which is stored unescaped in wallet_log.information. The attacker submits a withdrawal request; when an administrator opens pendingRequests.php to review it, the script runs in the admin session and issues same-origin fetch calls to perform administrative actions (e.g., creating an admin user or changing settings). No public POC was identified at time of analysis.