Vulnerability · Published May 15, 2026 · Assigned by GitHub_M

CVE-2026-44366Vvveb: Stored XSS via Comment Author Field

Medium 6.1

In plain English

A medium-severity cross-site scripting in Vvveb from givanz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 79.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.1, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Vvveb CMS comment submission flow. The author field is submitted by an unauthenticated user on any public post page, stored without sanitization, and later rendered unsanitized in two distinct sinks: This vulnerability is fixed in 1.0.8.1.

Affected products (as reported)

Vendor	Product	Versions
givanz	Vvveb	< 1.0.8.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/givanz/Vvveb/security/advisories/GHSA-gpmg-pcxr-9wvf x_refsource_CONFIRM