# CVE-2024-29271: VvvebJs reflected XSS in save.php action parameter

Source: https://junglewise.ai/threats/cve-2024-29271-vvvebjs-reflected-xss-in-save-php-action-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-03-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-29271 · Severity: low · CVSS 3.1 · Published 2024-03-22

VvvebJs is a JavaScript page builder and design tool. A reflected cross-site scripting (XSS) vulnerability in the save.php file allows attackers to execute arbitrary code in a victim's browser by crafting a malicious link. An attacker could steal session cookies, credentials, or sensitive page content, or perform actions on behalf of the victim.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-29271 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-29271 being exploited in the wild.

**How severe is CVE-2024-29271?** Low severity, with a CVSS score of 3.1, published 22 March 2024.

**Which products and versions are affected?** vvvebJs (npm) SEMVER:introduced=0,fixed=1.7.5.

**Is there a fix for CVE-2024-29271?** Yes. vvvebJs (npm): upgrade to 1.7.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-29271 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-29271?** Check whether you run vvvebJs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- vvvebJs (npm): upgrade to 1.7.5 or later

  ```sh
  npm install vvvebJs@1.7.5
  ```


## Technical details

A reflected XSS vulnerability (CWE-79) exists in VvvebJs versions before 1.7.5 in the save.php file's action parameter. The vulnerability stems from unsanitized user input from the GET parameter "action" being directly reflected into HTML error messages without escaping or filtering. An attacker can craft a link containing JavaScript payload (e.g., `?action=<script>alert('test')</script>`) and trick a user into clicking it; when loaded, the script executes in the victim's browser within the application's security context. The attack requires user interaction (clicking a link) and succeeds against any user who clicks the malicious URL. The vulnerability was patched in version 1.7.5.

## Affected products

- VvvebJs VvvebJs before 1.7.5

## Identifiers

- CVE-2024-29271
- GHSA-pc95-3wgm-x28p

## Timeline

- 2024-03-11: disclosed: Issue reported on GitHub
- 2024-03-22: advisory: GHSA and CVE published
- 2024-03-22: patched: Fixed in version 1.7.5

## References

- [https://github.com/givanz/VvvebJs/issues/342](https://github.com/givanz/VvvebJs/issues/342)

## Related threats

- [VvvebJs arbitrary file upload in save.php](https://junglewise.ai/threats/cve-2024-29272-vvvebjs-arbitrary-file-upload-in-save-php)