CVE-2026-126369

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.7

Description A stored cross-site scripting issue exists where low-privilege author or vendor users can inject scripts by bypassing the regex blacklist in the sanitizeHTML() function. This allows attackers to save post or product content containing unclosed event-handler tags or javascript: entities, which then execute for anonymous visitors and administrators, potentially leading to the theft of sessions or CSRF tokens.

Recommendations Update Vvveb to version 1.0.8.7 or later. As a temporary workaround, restrict the permissions of author and vendor users to prevent them from saving post or product content until the update is applied.