Vvveb versions prior to 1.0.8.2 contain a reflected cross‑site scripting flaw in the visual editor preview renderer. An attacker can inject arbitrary JavaScript by manipulating the r query parameter and the _component_ajax POST payload, which the system renders without any session, role, or token checks and without sanitizing the content. The flaw is a classic CWE‑79 problem and allows an unauthenticated user to force a victim’s browser to execute malicious code in the context of the Vvveb website, potentially leading to theft of session cookies, defacement, or further phishing attacks.

The vulnerability affects the Vvveb content management system from the Givanz vendor. Any installation running a version older than 1.0.8.2 is impacted; versions 1.0.8.2 and later contain the fix.

The CVSS score of 5.1 places this flaw in the moderate range, and the EPSS score is currently unavailable, indicating no public exploitation data yet. Because the attack vector is unauthenticated and relies on a malicious link or auto‑submitted form, the likelihood of exploitation depends on the presence of vulnerable users and their exposure to external traffic. The flaw is not listed in the CISA KEV catalog, so no known active exploits have been reported. Nonetheless, any web application that exposes the visual editor to unauthenticated users should be treated as a security risk.