WWBN AVideo CVE-2026-89253

Requires the CustomizeUser plugin option allowDonationLink to be enabled (this renders the donation button on the watch page); without it the sink is not reached. The attacker must hold a valid authenticated account able to update its own profile via objects/userUpdate.json.php (PR:L). Exploitation against a victim requires user interaction (UI:P): the victim must view the attacker's video watch page and interact with the donation button (e.g. hover to fire onmouseover). Limiting factors: non-default plugin configuration, need for a registered account, and required victim interaction.

The supplied CVSS 4.0 score of 9.3 (VC:H/VI:H/SC:H/SI:H) is high, but this is a stored XSS whose true impact is script execution in a victim's browser session, not direct high-confidentiality/high-integrity compromise of the server - the H impact ratings appear overstated for a DOM-context XSS. The vector's honest signals are more instructive: AV:N (network) but PR:L (attacker must be an authenticated AVideo user) and UI:P (a victim must load the attacker's video page and interact with, e.g. hover over, the donation button). No EPSS or KEV data was provided; there is no indication of active exploitation, so this is 'publicly available exploit code exists' rather than in-the-wild abuse. Real-world priority is moderate-to-high for sites that (a) allow user registration and (b) have enabled the non-default CustomizeUser allowDonationLink option - the admin-session-hijack potential (an admin hovering the button on an attacker's video) is the meaningful escalation path. The requirement for a specific plugin option and user interaction materially limits blast radius versus the raw 9.3 score.

An attacker registers a normal AVideo account and, via objects/userUpdate.json.php, sets their donationLink to a URL crafted to break out of the href attribute and add an onmouseover event handler (e.g. http://evil.example/"onmouseover=alert(document.domain)//). They upload or share a video; when an administrator (or any visitor) opens that video's watch page and hovers over the donation button, the injected JavaScript runs in the victim's authenticated session, enabling session/cookie theft or admin-action forgery. Exploit details are publicly documented in the VulnCheck advisory.