CVE-2026-126369 · Package
NO FIX YET
Vvveb through 1.0.8.6 fails to sanitize post and product content, so an author or vendor user can save markup that runs script in visitors' and admins' browsers. An attacker can use this to steal session cookies or CSRF tokens.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Vvveb through 1.0.8.6 where author or vendor accounts can save post or product content. Visitors and admins viewing that content are the targets. Sites without those roles, or on a later version, are likely not affected, but the sources do not confirm a fixed version.
Not affected if no-untrusted-authors
Who cares cms, self-hosted, vvveb
1.0.8.6 or earlier.No fix yet, per the sources.
Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML(). Attackers can save post or product content with unclosed event-handler tags or javascript: entities to execute script for anonymous visitors and admins, enabling session or CSRF-token theft.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.