Is there a patch available for EUVD-2026-30579?

Yes, a patch is available for EUVD-2026-30579. Update the affected software to the latest version immediately.

Vvveb CMS EUVD-2026-30579

Q: What is the CVSS score of EUVD-2026-30579?

EUVD-2026-30579 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-45616 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-15 GitHub_M

XSS Vvveb Givanz

5.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

May 15, 2026 - 20:02 EUVD

Analysis Generated

May 15, 2026 - 19:36 vuln.today

CVSS changed

May 15, 2026 - 19:22 NVD

5.1 (MEDIUM)

DescriptionGitHub Advisory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, This vulnerability is fixed in 1.0.8.3.

AnalysisAI

Cross-site scripting (XSS) in Vvveb CMS versions prior to 1.0.8.3 allows authenticated users to inject malicious scripts that execute in victim browsers with user interaction. The CVSS 4.0 vector indicates network-based attack requiring low-privilege authentication and user interaction, with low confidentiality and integrity impact to the subsequent system. GitHub security advisory confirms the vulnerability, with patch version 1.0.8.3 available. No public exploit code identified at time of analysis, and EPSS data not available for this recently assigned CVE.

Technical ContextAI

Vvveb is a web-based content management system with integrated page builder functionality for creating websites, blogs, and ecommerce platforms. This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating insufficient sanitization of user-supplied input before rendering in HTML context. The CVSS 4.0 vector specifies subsequent system impact (SC:L/SI:L) rather than vulnerable system impact, suggesting stored XSS where the payload persists and affects other users rather than reflected XSS. The CPE identifier cpe:2.3:a:givanz:vvveb targets the givanz vendor namespace, confirming this affects the open-source Vvveb project hosted on GitHub.

RemediationAI

Upgrade Vvveb CMS to version 1.0.8.3 or later immediately, as confirmed by GitHub security advisory GHSA-39gc-pjv5-4w4p at https://github.com/givanz/Vvveb/security/advisories/GHSA-39gc-pjv5-4w4p. Verify installation version through admin panel or version files before and after upgrade. If immediate patching is not feasible, implement compensating controls: restrict CMS access to trusted administrators only via IP allowlisting or VPN (reduces PR:L attack surface but limits usability for distributed teams); implement Content Security Policy headers with strict script-src directives to prevent inline script execution (may break legitimate Vvveb page builder functionality requiring careful testing); enable Web Application Firewall rules to detect and block common XSS patterns in POST requests to admin endpoints (creates maintenance overhead for rule tuning). All compensating controls reduce functionality or create operational burden compared to applying the vendor patch.