CVE-2026-55230 is a cross-site scripting vulnerability in givanz Vvveb CMS affecting versions before 1.0.8.6. The issue arises because the HTML sanitizer does not properly strip event-handler attributes if a tag contains a greater-than character inside a quoted attribute value. This allows low-privilege content authors to store malicious JavaScript in content, which executes in the browsers of visitors and administrators viewing the content, enabling potential admin account compromise. The vulnerability is addressed in version 1.0.8.6.

Successful exploitation allows low-privilege users to execute arbitrary JavaScript in the context of the CMS, affecting all visitors and administrators who view the malicious content. This can lead to administrative account takeover, compromising the integrity and security of the CMS and its managed websites. The CVSS score of 8.7 reflects high impact on confidentiality and integrity with no impact on availability.

Upgrade to Vvveb version 1.0.8.6 or later, where the HTML sanitizer correctly strips event-handler attributes even when tags contain greater-than characters inside quoted attribute values. This patch fully addresses the vulnerability. No additional mitigation is required once the update is applied.