A stored cross-site scripting vulnerability in the AVideo YPTWallet plugin allows authenticated attackers to compromise administrative sessions and perform unauthorized actions.

This vulnerability is a stored cross-site scripting (CWE-79) flaw within the YPTWallet plugin, triggered when malicious input is stored in the wallet_log.information field. An authenticated user can inject scripts that execute when an administrator views the pending withdrawal requests in the pendingRequests.php file.

The exploitation of this vulnerability poses a severe risk to organizational security, as it allows an attacker to hijack an administrative session. Given the CVSS score of 8.7, this is a high-severity issue that could lead to unauthorized system configuration changes, data exfiltration, or complete administrative account takeover, resulting in significant operational and reputational damage.

Immediate Action: Review the official GitHub security advisory provided by WWBN to identify available patches or mitigation commits, as no specific version number for a fix is currently provided.

Proactive Monitoring: Monitor server access logs for anomalous activity directed at pendingRequests.php and inspect the wallet_log database table for suspicious or base64-encoded strings containing script tags.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and deploy a Web Application Firewall (WAF) to filter malicious payloads from user-supplied input fields.

Public Exploit Available: Unknown

Due to the potential for full administrative account compromise, this vulnerability must be treated with high priority. Organizations using the AVideo platform with the YPTWallet plugin enabled should audit their current commit level and apply any available security patches from the vendor immediately to neutralize this stored cross-site scripting vector.