The vulnerability in WWBN AVideo's YPTWallet plugin involves improper neutralization of input during web page generation. Specifically, CryptoWallet values provided by users are base64-encoded but lack HTML escaping before storage, resulting in stored cross-site scripting. This allows an attacker to inject malicious scripts that execute in the context of an administrator's session when viewing pending withdrawal requests, potentially enabling unauthorized administrative actions through same-origin fetch requests.

Successful exploitation allows attackers to execute arbitrary scripts in the administrator's browser session when viewing pending withdrawal requests. This can lead to unauthorized administrative actions being performed via same-origin fetch requests. The CVSS 4.0 score of 9.3 reflects a critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when viewing pending withdrawal requests and consider restricting access or applying temporary mitigations such as input validation or output encoding on CryptoWallet values.