CVE-2026-44366

A stored cross-site scripting (XSS) vulnerability exists in Vvveb CMS versions prior to 1.0.8.1. The author field submitted during comment creation is not sanitized before storage and is later rendered unsanitized in two distinct sinks [1].

The vulnerability can be exploited by any unauthenticated user on a public post page. By submitting a malicious payload in the author field, the attacker triggers script execution in two contexts: (1) in the admin panel, when an admin clicks the author name link in the comments moderation dashboard, and (2) on the public post page, when any visitor clicks the Reply button on the malicious comment [1].

The impact includes arbitrary JavaScript execution in the context of the victim's browser. In the admin sink, an attacker could potentially steal session cookies or perform actions on behalf of the admin. In the public sink, any visitor clicking Reply is affected, broadening the attack surface significantly [1].

This vulnerability is fixed in Vvveb CMS version 1.0.8.1. Users are advised to update to the latest version immediately [1].