CVE-2026-55230

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.6

Description The HTML sanitizer fails to strip event-handler attributes when a tag contains a greater-than character within a quoted attribute value. This allows a low-privilege content author, such as those with the author or contributor role, to store a malicious payload in post or product content. When a visitor or administrator views or previews the content, the payload executes JavaScript in their browser, potentially leading to the takeover of administrator accounts.

Recommendations Update to version 1.0.8.6.