CVE-2026-55230High· 8.7▾ MidnightPoC availableVvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 47.8 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content author (default role author or contributor) can store a payload in post or product content that runs JavaScript in a browser of every visitor and of any administrator who views or previews that content, which opens a path to admin account takeover. This issue has been patched in version 1.0.8.6.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55231High· 7.2Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
CVE-2026-54506High· 7.6Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
CVE-2026-55232High· 7.6Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
CVE-2026-54613Medium· 5.4Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
CVE-2026-54612High· 8.8Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
CVE-2026-54507High· 8.4Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores