CVE-2026-41929 describes an unauthenticated reflected cross-site scripting vulnerability in Vvveb prior to version 1.0.8.2. The issue exists in the visual editor preview renderer where the 'r' query parameter and '_component_ajax' POST parameter are not properly neutralized. The gating function isEditor() fails to perform session, role, or token verification, and the view handler injects raw HTML POST body content without sanitization, enabling attackers to execute arbitrary JavaScript in the context of the Vvveb origin. This can be exploited by crafting malicious links or auto-submitted forms that cause victim browsers to run attacker-controlled scripts.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of the vulnerable Vvveb application without authentication. This can lead to session hijacking, defacement, or other client-side attacks within the scope of the affected origin. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the visual editor preview renderer if possible and avoid exposing it to untrusted users. Monitor vendor channels for updates and apply patches promptly once released.