CVE-2026-44366: Vvveb: Stored XSS via Comment Author Field
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.1, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Vvveb CMS comment submission flow. The author field is submitted by an unauthenticated user on any public post page, stored without sanitization, and later rendered unsanitized in two distinct sinks: This vulnerability is fixed in 1.0.8.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44366?
CVE-2026-44366 is classified as a high severity vulnerability due to its potential to manipulate user sessions through stored XSS attacks.
How do I fix CVE-2026-44366?
To fix CVE-2026-44366, upgrade Vvveb CMS to version 1.0.8.1 or later.
What type of vulnerability is CVE-2026-44366?
CVE-2026-44366 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the comment submission feature.
Which versions of Vvveb CMS are affected by CVE-2026-44366?
Versions of Vvveb CMS prior to 1.0.8.1 are affected by CVE-2026-44366.
What impact does CVE-2026-44366 have on users?
CVE-2026-44366 allows attackers to inject malicious scripts through the comment author's field, potentially compromising users’ data.