CVE-2026-126369
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML(). Attackers can save post or product content with unclosed event-handler tags or javascript: entities to execute script for anonymous visitors and admins, enabling session or CSRF-token theft.