CVE-2026-41932 is a stored cross-site scripting vulnerability in givanz Vvveb prior to version 1.0.8.3. The issue occurs in the customer signup flow where the Signup::addUser() controller copies raw POST username input into the display_name field before sanitization. Although the username column removes HTML/script markup, the display_name field retains it verbatim. When display_name is rendered without proper encoding in vulnerable views, this enables stored XSS attacks. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). No patch or official remediation level has been published, and no exploits are known in the wild.

An attacker can submit malicious HTML or script code in the username field during signup, which is stored unsanitized in the display_name field. This stored malicious content can execute in the context of users viewing affected pages, potentially leading to session hijacking, defacement, or other XSS-related impacts. The vulnerability requires user interaction (UI:P) and has low complexity (AC:L). It does not require privileges or authentication (PR:N) and has limited impact on confidentiality and integrity but some impact on availability and security controls as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input sanitization and output encoding on the display_name field to prevent script execution. Avoid rendering display_name without proper encoding in any views. Monitor vendor communications for updates on patches or official mitigations.