CVE-2026-55230: Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content author (default role author or contributor) can store a payload in post or product content that runs JavaScript in a browser of every visitor and of any administrator who views or previews that content, which opens a path to admin account takeover. This issue has been patched in version 1.0.8.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.6
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the stored payload?
A low-privilege Vvveb content author, including users with the default author or contributor role, can exploit it by placing crafted content in a post or product. The stored JavaScript can execute for every visitor and for administrators who view or preview the affected content.
Does exploitation require administrative access or a complex attack setup?
No. The vulnerable sanitizer can be bypassed by a low-privilege authenticated content author using a quoted greater-than character in an attribute value. Exploitation does require a victim to view or preview the stored content.
What versions are affected and what version fixes the issue?
Vvveb versions prior to 1.0.8.6 are affected. The issue is patched in version 1.0.8.6.
What is the likely impact if an administrator views malicious content?
The payload can run JavaScript in the administrator's browser, creating a path to administrator account takeover. Visitor browsers may also execute the stored script when viewing the affected post or product content.