WWBN AVideo contains a stored XSS vulnerability in the 'donationLink' user profile field. The setDonationLink() function stores user input validated only by filter_var() with FILTER_VALIDATE_URL, which does not prevent injection of malicious attribute-breaking strings. The getDonationLink() function applies strip_tags() but does not encode double quotes. The vulnerable value is output unencoded into an <a href="..."> attribute in plugin/CustomizeUser/actionButton.php, included on the watch page when allowDonationLink is enabled. An authenticated user can exploit this to inject event handlers that execute JavaScript in the browsers of visitors who interact with the donation button. The issue was unfixed at the time of reporting.

An authenticated user can inject malicious JavaScript that executes in the browsers of any visitor, including administrators, who view the attacker's videos and interact with the donation button. This can lead to session hijacking, privilege escalation, or other malicious actions within the context of the affected website. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with high impact on confidentiality, integrity, and availability.

No official fix or patch was available at the time of reporting. Users should monitor the vendor's advisory for updates. Until a fix is released, consider disabling the allowDonationLink option to prevent the donation button from rendering user-controlled URLs. Avoid interacting with donation links from untrusted users. Implement additional input validation and output encoding for the donationLink field to prevent injection.