CVE-2026-126369: Vvveb through 1.0.8.6 Stored XSS via sanitizeHTML() Blacklist Bypass
Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML(). Attackers can save post or product content with unclosed event-handler tags or javascript: entities to execute script for anonymous visitors and admins, enabling session or CSRF-token theft.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to submit a malicious payload?
The attacker needs a low-privilege author or vendor account. The attack is network-accessible and rated low complexity, but does not require administrative privileges.
Who is at risk when malicious content is published?
Anonymous visitors and administrators who view the affected post or product content can have script executed in their browser. This can expose session data or CSRF tokens and may affect a different security scope than the attacker's original account.