A stored cross‑site scripting flaw in Vvveb CMS allows a user with access to the post editor to embed malicious JavaScript that is saved in the database. When other users view the affected post, the script runs in their browser with the privileges of the viewing user. This can be used to steal session cookies or perform actions that require higher privileges, effectively letting an attacker escape the limited editor role and acquire administrative control.

All installations of Vvveb CMS versions earlier than 1.0.8.3. The vulnerability is present in the post editor module of every release before 1.0.8.3 and has been fixed in that release.

The CVSS score of 5.1 indicates moderate risk and the EPSS score is unavailable, leaving the probability of exploitation uncertain. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated editor inserting malicious code via the post editor, and based on the description it is inferred that the script runs with the viewing user’s privilege, enabling privilege escalation. Exploitation requires no special network access and can be performed through the CMS UI, making it attractive to those who compromise an editor account or abuse the feature.