---
id: "CVE-2026-126369"
page: "https://infrastack.ai/live/CVE-2026-126369"
kind: "vulnerability"
aliases: ["CVE-2026-126369"]
title: "Vvveb: stored XSS lets low-privilege authors run script in admin sessions"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cms", "package", "self-hosted", "vvveb"]
not_affected_if: ["no-untrusted-authors"]
published_at: "2026-11-13T10:17:38+00:00"
first_seen_at: "2026-11-13T10:47:16+00:00"
updated_at: "2026-11-13T10:57:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126369", "first_seen_at": "2026-11-13T10:47:16+00:00"}]
exploit_sources: []
---

# Vvveb: stored XSS lets low-privilege authors run script in admin sessions

Link for people: https://infrastack.ai/live/CVE-2026-126369 (this .md is for agents)

Vvveb through 1.0.8.6 fails to sanitize post and product content, so an author or vendor user can save markup that runs script in visitors' and admins' browsers. An attacker can use this to steal session cookies or CSRF tokens.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Vvveb version against `1.0.8.6` or earlier.
- Review whether untrusted users hold author or vendor roles in the admin panel.

## Timeline

- 2026-11-13T10:47:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126369

## Documents

- [advisory] Vendor advisory: github.com https://github.com/givanz/Vvveb/security/advisories/GHSA-prqj-4768-vcmq
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-stored-xss-via-sanitizehtml-blacklist-bypass

## From the sources

Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML(). Attackers can save post or product content with unclosed event-handler tags or javascript: entities to execute script for anonymous visitors and admins, enabling session or CSRF-token theft.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_