NukeViet versions prior to 4.6.00 contain multiple filter bypasses in the News module's input sanitization, allowing authenticated users with news-posting permissions to inject stored cross-site scripting (XSS) payloads. The vulnerabilities arise from improper filtering of event handler attributes and incomplete decoding of HTML entities, enabling persistent JavaScript execution in any visitor's browser. This can lead to session hijacking, credential theft, and privilege escalation. A patch has been committed that properly strips control characters and decimal HTML entities to prevent these bypasses. No workarounds exist other than updating to the fixed version.