The givanz Vvveb CMS before version 1.0.8.1 contains a stored cross-site scripting vulnerability (CWE-79) in its comment submission feature. Specifically, the author field can be submitted by unauthenticated users and is stored without sanitization. This unsanitized input is later rendered in two distinct sinks on public post pages, enabling stored XSS attacks. The vulnerability has been assigned CVE-2026-44366 and has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. The vulnerability is fixed in version 1.0.8.1 of Vvveb.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the browsers of users viewing affected pages, potentially leading to information disclosure or manipulation of user interactions within the context of the vulnerable website. The impact is limited to confidentiality and integrity with no availability impact. No known active exploitation has been reported.

Upgrade the givanz Vvveb CMS to version 1.0.8.1 or later, where this stored XSS vulnerability has been fixed. Since the vendor advisory indicates the issue is resolved in this version, applying this official fix is the recommended remediation. No additional mitigation steps are specified or required.