An unknown function in Vvvebjs’s upload.php file is vulnerable to manipulation of the uploadAllowExtensions argument, allowing arbitrary cross‑site scripting payloads to be executed in the victim’s browser. This client‑side code injection can lead to session hijacking, data theft, or defacement if unsuspecting users visit the affected page. It is classified as CWE‑79 and potentially CWE‑94 due to code execution paths.

The vulnerability affects the givanz Vvvebjs product, version 2.0.5 and earlier. Versions later than 2.0.5 are not listed as vulnerable, suggesting they have been patched. The product is an open‑source website CMS written in PHP and JavaScript, with the vulnerable component being the File Upload Endpoint.

The CVSS score of 5.3 indicates moderate risk, and the attack vector is remote via HTTP requests to the upload.php endpoint. A publicly available exploit exists, increasing the likelihood of exploitation before a patch is deployed. The KEV status is not listed, but the quick release of the patch demonstrates vendor responsiveness. The likely attack path is through crafting a request that manipulates the uploadAllowExtensions parameter to inject malicious script code.