External risk intelligence

AVideo YPTWallet Plugin Stored Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-89249

AVideo is commonly deployed as a public-facing video streaming and content platform. The vulnerability exists within a plugin that interacts with user-supplied data, which is processed and viewed by administrators in the application's administrative interface. Given the nature of the software as a web-based service, the administrative panel is a core component often accessible via the network.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a stored cross-site scripting vulnerability within the YPTWallet plugin for AVideo, where improperly handled user-supplied data allows for administrative actions to be performed by authenticated users with lower privileges. The main concern is confirming relevance and exposure.

Stored code can let some users take admin actions.
High-impact flaw in a common video platform plugin.
Confirm if this platform and plugin are in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by first submitting crafted CryptoWallet values to the vulnerable AVideo plugin. These values are stored without proper escaping and are later displayed to administrators when they review pending withdrawal requests. When an administrator views these requests, their browser executes the malicious script embedded in the stored data, allowing the attacker to perform actions within the administrator's session.

Requires user-supplied input.
Triggered by an administrator viewing requests.
Allows arbitrary administrative actions.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, this vulnerability could allow an attacker to perform administrative actions by injecting malicious markup into the AVideo platform. This could occur when administrators review pending withdrawal requests, as user-supplied values are stored and executed without proper HTML escaping.

Admin actions may be performed.
Stored markup is executed by admins.
Unauthorized administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

Application owners and infrastructure teams are likely responsible for addressing this stored cross-site scripting vulnerability in the YPTWallet plugin. The first practical step involves identifying all AVideo instances, confirming their network reachability and business criticality, and then assigning ownership to the accountable team for a risk-based remediation plan.

Application owners must prioritize this issue.
Verify administrator access and plugin usage.
Plan coordinated remediation with vendor support.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AVideo?

AVideo is an open-source platform designed for hosting, streaming, and managing video content. It functions as a web-based service where users can upload and view media. The software supports various extensions, including the YPTWallet plugin, which facilitates financial transactions or balance tracking for platform users.

What does CVE-2026-89249 mean by stored cross-site scripting?

This is a CWE-79 weakness where the application saves malicious code provided by a user into its database without cleaning it first. In this specific case, the YPTWallet plugin fails to properly escape input, allowing harmful scripts to reside permanently within the system's log files until an administrator views them.

How is the malicious code triggered in this vulnerability?

An attacker must first submit a crafted value into the CryptoWallet field within the plugin. The vulnerability does not trigger if that data remains unviewed; it only executes when an administrator logs in and accesses the pending withdrawal requests page, which causes the stored script to run automatically within the administrator's browser session.

Is my AVideo instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates that AVideo is often deployed as a public-facing platform, making its administrative interfaces potential targets. If your instance is accessible over the network and uses the YPTWallet plugin, you should consider it a priority, as administrators are the ones who interact with the stored malicious data during daily operations.

What should I do first to manage this AVideo security issue?

Start by identifying all AVideo installations in your environment to determine if the YPTWallet plugin is active. Once identified, evaluate the business criticality of those specific instances and assign ownership to the appropriate technical team to prepare for a remediation plan as advised by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.