Vulnerability · Published May 7, 2026 · Assigned by VulnCheck

CVE-2026-41929Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor

Medium 6.1

In plain English

A medium-severity cross-site scripting in Vvveb from givanz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 84.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and _component_ajax POST parameter. Attackers can craft a malicious link or auto-submitted form that causes victims to execute attacker-controlled JavaScript in the context of the Vvveb origin, as the gating function isEditor() performs no session, role, or token verification and the view handler injects raw HTML POST body content without sanitization.

Affected products (as reported)

Vendor	Product	Versions
givanz	Vvveb	0 – before 1.0.8.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/givanz/Vvveb/releases/tag/1.0.8.2 release-notes
https://github.com/givanz/Vvveb/security/advisories/GHSA-wwmv-4g9g-p48g vendor-advisory
https://github.com/givanz/Vvveb/commit/54a9e846fb94192f1b31ae81d81d25c874662e6a patch
https://www.vulncheck.com/advisories/vvveb-unauthenticated-reflected-xss-via-visual-editor third-party-advisory