CVE-2026-44366 Details

A stored cross-site scripting vulnerability has been identified in Vvveb CMS versions prior to 1.0.8.1. This issue arises in the comment submission process, where the author field is submitted by unauthenticated users on public post pages. The field is stored without proper sanitization and later rendered unsanitized in two different contexts. In the admin panel, the vulnerability allows arbitrary JavaScript execution in the admin's session by clicking a link in the comments moderation dashboard. On the public post page, the malicious script is executed in the browser of any visitor who clicks the Reply button on the affected comment, bypassing the need for admin interaction.

To address this vulnerability, Vvveb CMS users should update to version 1.0.8.1 or later. Additionally, it is recommended to validate and sanitize the author field during comment submission, encode the author value when rendering in the admin panel and public post pages, and implement a Content-Security-Policy to block inline script execution.