CVE-2026-41929 Details
Description
Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and _component_ajax POST parameter. Attackers can craft a malicious link or auto-submitted form that causes victims to execute attacker-controlled JavaScript in the context of the Vvveb origin, as the gating function isEditor() performs no session, role, or token verification and the view handler injects raw HTML POST body content without sanitization.
A reflected cross-site scripting vulnerability has been identified in Vvveb CMS versions prior to 1.0.8.2. This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of the Vvveb origin. The issue arises in the visual editor preview renderer, where the 'isEditor()' function fails to perform proper session, role, or token verification. Instead, it only checks for the presence of a query parameter. As a result, attackers can manipulate the 'r' query parameter and the '_component_ajax' POST parameter to inject malicious scripts, which are then executed by victims when they interact with the editor preview.
Users can update to Vvveb CMS version 1.0.8.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 7, 2026CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/givanz/Vvveb/security/advisories/GHSA-wwmv-4g9g-p48g | CISA-ADP | AdvisoryExploitRemedy |
| https://github.com/givanz/Vvveb/commit/54a9e846fb94192f1b31ae81d81d25c874662e6a | [email protected] | Source CodeVendor |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.2 | [email protected] | Release NotesVendor |
| https://github.com/givanz/Vvveb/security/advisories/GHSA-wwmv-4g9g-p48g | [email protected] | AdvisoryExploitRemedy |
| https://www.vulncheck.com/advisories/vvveb-unauthenticated-reflected-xss-via-visual-editor | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vvveb | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |