Cross-Site Scripting Vulnerability in Vvveb CMS by Givanz
CVE-2026-54506

7.6HIGH

Key Information:

Vendor

Givanz

Status
Vvveb
Vendor
CVE Published:
17 September 2026

What is CVE-2026-54506?

Vvveb CMS, a versatile content management system, contains a Cross-Site Scripting (XSS) vulnerability in its user profile handling prior to version 1.0.8.5. The application improperly sanitizes user input in the bio field, which allows an Author-role or higher user to inject malicious JavaScript code. This issue arises from a flaw in the sanitizeHTML() function, where certain nested tags and event-handler markup can evade sanitization. As a result, when the stored bio is displayed—such as on user profiles or in comments—an attacker can execute scripts that may compromise user sessions, facilitate phishing, or lead to account hijacking. This vulnerability underscores the importance of rigorous input sanitization and output encoding to prevent unauthorized script execution that could harm site visitors and administrators alike.

Affected Version(s)

Vvveb < 1.0.8.5

References

https://github.com/givanz/Vvveb/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/givanz/Vvveb/commit/20a01ef08559ffdc97...
x_refsource_MISC
https://github.com/givanz/Vvveb/releases/tag/1.0.8.5
x_refsource_MISC

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.