# CVE-2026-54506: Vvveb CMS stored XSS in user bio

Source: https://junglewise.ai/threats/cve-2026-54506-vvveb-cms-stored-xss-in-user-bio  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54506 · Severity: high · CVSS 7.6 · Published 2026-09-17

Vvveb is a content management system with page builder used to create websites, blogs, and online stores. Users with author-level access can inject malicious JavaScript into their profile bio that bypasses the sanitization filter. When administrators, other users, or visitors view the affected profile or comments, the malicious code executes in their browser, potentially stealing session data, performing actions on their behalf, defacing the site, or launching phishing attacks.

Technologies: [Vvveb](https://junglewise.ai/threats/technologies/vvveb). Vendors: [Vvveb](https://junglewise.ai/threats/vendors/vvveb).

## Quick answers

**Is CVE-2026-54506 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54506 being exploited in the wild.

**How severe is CVE-2026-54506?** High severity, with a CVSS score of 7.6, published 17 September 2026.

**Which products and versions are affected?** Vvveb prior to 1.0.8.5.

**Is there a fix for CVE-2026-54506?** A patch was published on 2026-06-07: Fixed in version 1.0.8.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54506 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-54506?** Check whether you run Vvveb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in Vvveb's user profile bio functionality. The root cause is a flawed sanitizeHTML() function in system/functions.php that uses an incomplete regular expression for filtering event handlers (missing forward-slash delimiter) and compares a string to itself in its do-while condition, causing forbidden nested tags to be stripped only once rather than recursively. An attacker with Author role or higher can submit markup with solidus-prefixed event handlers (e.g., forward-slash-prefixed) or nested forbidden tags that survive this inadequate sanitization. The stored bio is rendered without proper output encoding on /author/{username}, in the admin user-management interface, and potentially in comments, allowing the injected JavaScript to execute in victim browsers. The vulnerability has been patched in version 1.0.8.5.

## Affected products

- Vvveb Vvveb prior to 1.0.8.5

## Timeline

- 2026-09-17: disclosed
- 2026-06-07: patched: Fixed in version 1.0.8.5

## References

- [https://github.com/givanz/Vvveb/commit/20a01ef08559ffdc97205edeecde86c8ea27e567](https://github.com/givanz/Vvveb/commit/20a01ef08559ffdc97205edeecde86c8ea27e567)
- [https://github.com/givanz/Vvveb/releases/tag/1.0.8.5](https://github.com/givanz/Vvveb/releases/tag/1.0.8.5)

## Related threats

- [Vvveb CMS authentication bypass in password reset](https://junglewise.ai/threats/cve-2026-110799-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)
- [Vvveb path traversal in backup functions](https://junglewise.ai/threats/cve-2026-112904-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)
- [Vvveb SSRF via IPv6 bypass in oEmbed proxy](https://junglewise.ai/threats/cve-2026-55232-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)
- [Vvveb CMS path traversal in sanitizeFileName](https://junglewise.ai/threats/cve-2026-55231-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)
- [Vvveb stored XSS via HTML sanitizer filter bypass](https://junglewise.ai/threats/cve-2026-55230-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)