The vulnerability exists in the sanitization logic of the user[bio] field in Vvveb CMS before version 1.0.8.5. The sanitizeHTML() function in system/functions.php fails to fully remove nested forbidden tags and allows solidus-prefixed event-handler attributes due to a flawed regular expression and loop condition. As a result, an attacker with Author or higher privileges can inject JavaScript that executes in the context of other users or administrators when viewing the stored bio on various pages. This improper neutralization of input leads to cross-site scripting, enabling potential session hijacking, unauthorized actions, defacement, or phishing attacks. The issue is resolved in version 1.0.8.5.

Successful exploitation allows attacker-controlled JavaScript execution in the browsers of unauthenticated visitors, administrators, or other users viewing the affected bio content. This can result in exposure of browser session data and enable actions performed with the victim's privileges, such as account manipulation, content defacement, or phishing. The CVSS score of 7.6 reflects a high severity with network attack vector, low attack complexity, and requiring privileges of Author role or higher with user interaction.

Upgrade to version 1.0.8.5 or later, where the vulnerability is fixed. No other mitigation is required as the official fix addresses the sanitization flaw.