Vvveb CMS EUVD-2026-91038

Requires an authenticated low-privilege account - the default 'author' or 'contributor' role - with permission to create or edit post or product content (PR:L). The specific sanitizer bypass is triggered by embedding an event-handler ('on*') attribute on a tag that also carries a greater-than character inside a quoted attribute value, which defeats Vvveb's sanitizeHTML stripping in versions prior to 1.0.8.6. Execution additionally requires that a victim - any site visitor, or an administrator who views or previews the stored content - actually renders the malicious content (UI:R); the high-value admin-takeover path depends on an administrator viewing it. Exploitation is blocked on patched 1.0.8.6+ installations and on deployments that do not grant untrusted users content-authoring roles.

This is a genuinely high-impact stored XSS (CWE-79) whose risk is driven by privilege escalation potential rather than raw exploitability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 8.7) is internally consistent with the description: a low-privilege author or contributor (PR:L) stores a payload that executes in the browser of a victim who views the content (UI:R), crossing a trust boundary into the admin context (S:C, which is what pushes the score to 8.7 and yields C:H/I:H). No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 8.7 reflects potential impact (admin account takeover), not demonstrated weaponization. The realistic priority is moderate-to-high for anyone actually running Vvveb with untrusted content authors: the precondition (an attacker-controlled low-privilege account) meaningfully narrows the exploit population, but the sanitizer-bypass is simple to trigger once that foothold exists. Key missing signals: no EPSS probability, no KEV status, and no POC flag were supplied, so likelihood of in-the-wild use cannot be quantified from this data.

An attacker obtains or is granted a default author/contributor account on a Vvveb site and creates a post or product whose content embeds an event-handler attribute hidden behind a quoted attribute value containing a '>' character, which the HTML sanitizer fails to strip. When an administrator previews or views that content, the injected JavaScript runs in the admin's authenticated session, enabling session/credential theft and admin account takeover. No public exploit was identified at time of analysis, though the patch commit publicly reveals the sanitizer-bypass technique.