CVE-2026-55230

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content author (default role author or contributor) can store a payload in post or product content that runs JavaScript in a browser of every visitor and of any administrator who views or previews that content, which opens a path to admin account takeover. This issue has been patched in version 1.0.8.6.

• CWE-79

• https://github.com/givanz/Vvveb/releases/tag/1.0.8.6
• https://github.com/givanz/Vvveb/security/advisories/GHSA-97xr-82vc-wj2v
• https://github.com/givanz/Vvveb/security/advisories/GHSA-97xr-82vc-wj2v

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55225Strimzi provides a way to run an Apache Kafka cluster on Kub…8
• CVE-2026-55226Strimzi provides a way to run an Apache Kafka cluster on Kub…5.4
• CVE-2026-55227Weblate is a web-based localization tool. In versions prior …4.3
• CVE-2026-55228Weblate is a web-based continuous localization platform used…8.1
• CVE-2026-55229Gotenberg is a Docker-powered stateless API for PDF files. P…7.5
• CVE-2026-5523The Divi Form Builder plugin for WordPress is vulnerable to …8.8
• CVE-2026-55231Vvveb is a powerful and easy to use CMS with page builder to…7.2
• CVE-2026-55232Vvveb is a powerful and easy to use CMS with page builder to…7.6
• CVE-2026-55233OpenResty is a high performance web platform. From 1.29.2.1 …7.5
• CVE-2026-55234Wekan is open source kanban built with Meteor. Prior to 9.37…8.5
• CVE-2026-55235langgraph-api implements the LangGraph API for rapid develop…5.9
• CVE-2026-55236langgraph-api implements the LangGraph API for rapid develop…5.9