Vvveb CMS: Stored cross-site scripting via sanitizer bypass

Summary

Vvveb, an open-source PHP content management system, fails to remove event-handler attributes from HTML when a tag contains a greater-than character inside a quoted attribute value. A low-privileged author or contributor can store malicious JavaScript in post or product content. The script runs in the browser of every visitor and of any administrator who views or previews that content, which can lead to hijacking of an admin session and takeover of the CMS. Exploitation requires an author or contributor account and an administrator or visitor to view the content.

Affected

• Vvveb versions below 1.0.8.6 (CNA: all versions below 1.0.8.6; GitHub advisory: up to and including 1.0.8.5)

Fixed in

• Fixed in Vvveb 1.0.8.6 (fix commit c466e61, released 11 Jun 2026 per the vendor release page)

Workaround

• Unknown. No vendor-published interim mitigation found.
• Interim measure (not from vendor): restrict author and contributor accounts to trusted users and review existing post and product content for event-handler attributes.

Exploitation

• CISA SSVC: exploitation status 'poc', automatable: no.
• No confirmed in-the-wild exploitation found; not listed in KEV.
• Public proof of concept: none found in the vendor advisory or the consulted sources.

Our recommendation

• Identify all Vvveb installations and their versions.
• Upgrade to the latest release, at least 1.0.8.6.
• Review author and contributor accounts and existing posts and products for suspicious event-handler attributes.
• Restrict admin area access where it is not needed from the internet.
• Prioritise sites with multiple author accounts or not yet on 1.0.8.6.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Release Vvveb 1.0.8.6 github.com
• GitHub Security Advisory GHSA-97xr-82vc-wj2v github.com
• OSV CVE-2026-55230 osv.dev
• VulDB CVE-2026-55230 vuldb.com
• Strix CVE-2026-55230 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:17.