Executive brief
Vvveb is a content management system with page builder used to create websites, blogs, and online stores. Users with author-level access can inject malicious JavaScript into their profile bio that bypasses the sanitization filter. When administrators, other users, or visitors view the affected profile or comments, the malicious code executes in their browser, potentially stealing session data, performing actions on their behalf, defacing the site, or launching phishing attacks.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in Vvveb's user profile bio functionality. The root cause is a flawed sanitizeHTML() function in system/functions.php that uses an incomplete regular expression for filtering event handlers (missing forward-slash delimiter) and compares a string to itself in its do-while condition, causing forbidden nested tags to be stripped only once rather than recursively. An attacker with Author role or higher can submit markup with solidus-prefixed event handlers (e.g., forward-slash-prefixed) or nested forbidden tags that survive this inadequate sanitization. The stored bio is rendered without proper output encoding on /author/{username}, in the admin user-management interface, and potentially in comments, allowing the injected JavaScript to execute in victim browsers. The vulnerability has been patched in version 1.0.8.5.
Affected products
- Vvveb Vvveb prior to 1.0.8.5
Timeline
- 2026-09-17: disclosed
- 2026-06-07: patched: Fixed in version 1.0.8.5