A critical cross-site scripting vulnerability in WWBN AVideo allows unauthenticated attackers to exfiltrate user credentials via malicious URL injection.

The YPTWallet payment confirmation page fails to sanitize the plugin parameter before echoing it into a JavaScript block, enabling reflected cross-site scripting (XSS). An unauthenticated attacker can leverage this flaw to execute arbitrary scripts in a victim's browser, which specifically exposes the current user's username and password hash.

The ability to exfiltrate cleartext-equivalent credentials for any user who clicks a malicious link poses a severe risk of unauthorized account access and potential privilege escalation. Given the CVSS score of 8.2, this vulnerability represents a high-severity threat that could lead to widespread credential theft and compromise of the video platform's administrative or user accounts.

Immediate Action: As no official patch version is currently listed, administrators should restrict access to the YPTWallet payment confirmation page or disable the affected plugin entirely until an official update is released.

Proactive Monitoring: Monitor web server logs for suspicious URL parameters containing JavaScript payloads or unusual traffic patterns directed toward the YPTWallet module.

Compensating Controls: Implement a strict Content Security Policy (CSP) to mitigate the impact of XSS attacks and deploy a Web Application Firewall (WAF) to filter malicious input in the plugin parameter.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the exposure of sensitive user account data, necessitates immediate attention. Organizations utilizing WWBN AVideo should prioritize mitigating the exposure of the YPTWallet component and verify if the referenced GitHub commit can be applied manually to their environments to remediate the flaw.