CVE-2026-126369
Deferred Deferred - Pending Action

Stored XSS in Vvveb CMS via Sanitization Bypass

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML(). Attackers can save post or product content with unclosed event-handler tags or javascript: entities to execute script for anonymous visitors and admins, enabling session or CSRF-token theft.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126369
EUVD
EUVD-2026-125196

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
givanz Vvveb From 0 (inc) to 1.0.8.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-126369 is a stored cross-site scripting (XSS) vulnerability in Vvveb through version 1.0.8.6. It occurs because the sanitizeHTML() function uses a regex blacklist that can be bypassed by attackers with low privileges, such as authors or vendors. They can inject malicious scripts by using unclosed HTML tags or HTML5 entities like javascript: to evade security checks. These scripts execute when the content is viewed by anonymous visitors or administrators.

Detection Guidance

Check for unclosed HTML tags or suspicious event handlers in posts or product content. Inspect sanitized output for unfiltered scripts or javascript: entities. Review user-generated content for tags like <img onerror=> or similar event-based injections.

Impact Analysis

This vulnerability allows attackers to steal user sessions or CSRF tokens by injecting malicious scripts into posts or product content. When viewed, these scripts execute in the context of the victim's browser, potentially leading to unauthorized actions or data theft. Administrators viewing the content in the builder preview are also at risk.

Mitigation Strategies

Replace the blacklist-based sanitizer with a DOM-based allow-list sanitizer like HTML Purifier. Normalize and close dangling tags. Decode HTML5 entities before protocol checks. Update to the latest Vvveb version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126369. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...