https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T20:23:17.724847+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-45622 CVE-2026-45622 — Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id 2026-10-20T20:23:17.725827+00:00

Affected: givanz Vvveb

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an unauthenticated reflected cross-site scripting (XSS) issue in the public product return form in Vvveb CMS. The customer_order_id POST parameter is inserted into the Order %s not found! error message when the order lookup fails, and that message is rendered in the frontend template without HTML escaping. As a result, attacker-controlled HTML/JavaScript executes in the submitting user's browser. This vulnerability is fixed in 1.0.8.3.