CVE-2026-41929Medium· 6.1▾ TwilightPoC availableVvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and _componen…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 33.6 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and _component_ajax POST parameter. Attackers can craft a malicious link or auto-submitted form that causes victims to execute attacker-controlled JavaScript in the context of the Vvveb origin, as the gating function isEditor() performs no session, role, or token verification and the view handler injects raw HTML POST body content without sanitization.
Vvveb < 1.0.8.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-41938High· 8.8Vvveb < 1.0.8.2 RCE via Media Upload Handler
CVE-2026-34429Medium· 5.4Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename
CVE-2026-41931Medium· 5.3Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler
CVE-2026-41936High· 8.1Vvveb < 1.0.8.2 XML External Entity Injection via Import
CVE-2025-11027Low· 2.4A vulnerability was identified in givanz Vvveb up to 1.0.7.2
CVE-2026-55230High· 8.7Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores