# CVE-2026-44366: Givanz Vvveb CMS Stored XSS in comment author field

Source: https://junglewise.ai/threats/cve-2026-44366-givanz-vvveb-cms-stored-xss-in-comment-author-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-44366 · Severity: medium · CVSS 6.1 · Published 2026-05-15

Vvveb CMS is a content management system used for building websites, blogs, and online stores. A security flaw in its comment system allows unauthenticated visitors to submit malicious scripts disguised as a commenter's name. If a site administrator or another visitor interacts with the malicious comment, the attacker can execute code in their browser, potentially leading to account takeover, website defacement, or the theft of sensitive session information.

Technologies: [Givanz Vvveb CMS](https://junglewise.ai/threats/technologies/vvveb-cms). Vendors: [Givanz](https://junglewise.ai/threats/vendors/givanz).

## Quick answers

**Is CVE-2026-44366 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44366 being exploited in the wild.

**How severe is CVE-2026-44366?** Medium severity, with a CVSS score of 6.1, published 15 May 2026.

**Which products and versions are affected?** Givanz Vvveb CMS < 1.0.8.1.

**Is there a fix for CVE-2026-44366?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44366 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44366?** Check whether you run Givanz Vvveb CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in Vvveb CMS prior to version 1.0.8.1 due to improper sanitization of the 'author' field during comment submission. An unauthenticated attacker can submit a payload that is stored in the database and later rendered unsanitized in two locations: the 'href' attribute of the author link in the admin moderation panel (Sink A) and the 'data-comment-author' attribute on the public post page (Sink B). In the public sink, the value is processed by a client-side JavaScript function ('replyTo') using '.innerHTML', allowing for arbitrary script execution when a user clicks the 'Reply' button. This allows for session hijacking and unauthorized actions in the context of both administrators and regular site visitors. The issue is resolved in version 1.0.8.1.

## Affected products

- givanz Vvveb CMS < 1.0.8.1

## Timeline

- 2026-05-04: advisory: GitHub Security Advisory published
- 2026-05-15: disclosed: NVD publication date

## References

- [https://github.com/givanz/Vvveb/security/advisories/GHSA-gpmg-pcxr-9wvf](https://github.com/givanz/Vvveb/security/advisories/GHSA-gpmg-pcxr-9wvf)

## Related threats

- [Vvveb CMS authorization bypass in checkout endpoint](https://junglewise.ai/threats/cve-2026-46408-vvveb-cms-authorization-bypass-in-checkout-endpoint)
- [Givanz Vvveb CMS SQL injection in order history page](https://junglewise.ai/threats/cve-2026-45800-givanz-vvveb-cms-sql-injection-in-order-history-page)
- [Vvveb CMS reflected XSS in product return form](https://junglewise.ai/threats/cve-2026-45622-vvveb-cms-reflected-xss-in-product-return-form)
- [Vvveb CMS negative quantity input validation in cart-add endpoint](https://junglewise.ai/threats/cve-2026-44826-vvveb-cms-negative-quantity-input-validation-in-cart-add-endpoint)
- [Givanz Vvveb CMS reflected XSS in visual editor preview renderer](https://junglewise.ai/threats/cve-2026-41929-givanz-vvveb-cms-reflected-xss-in-visual-editor-preview-renderer)