Vvveb CMS prior to version 1.0.8.1 stores the content of the comment author field without any sanitization. When a user submits a comment on a public post, the value of the author field is persisted and later rendered unchecked in two separate output locations. This behavior enables a stored Cross‑Site Scripting (XSS) vulnerability that can execute arbitrary client‑side scripts in the context of any visitor to the affected page, potentially leading to session hijacking, defacement, or the execution of malicious code.

All installations of the Vvveb content management system running a release older than 1.0.8.1 are vulnerable. The flaw manifests on any public post page that accepts unauthenticated comments, and it does not require privileged access to exploit.

The CVSS score of 6.1 indicates medium severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying that no publicly known exploits have been observed. An attacker can trigger the issue simply by posting a crafted author string via the comment form; no additional setup or privileged credentials are required. Once the malicious comment is stored, it will be executed for all users who view the content, making containment difficult until the patched version is deployed or mitigated.