EUVD-2026-30583Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an unauthenticated reflected cross-site scripting (XSS) issue in the public product return form in Vvveb CMS. The customer_order_id POST parameter is inserted into the Order %s not found! error message when the order lookup fails, and that message is rendered in the frontend template without HTML escaping. As a result, attacker-controlled HTML/JavaScript executes in the submitting user's browser. This vulnerability is fixed in 1.0.8.3.
AnalysisAI
Unauthenticated reflected cross-site scripting (XSS) in Vvveb CMS versions prior to 1.0.8.3 enables attackers to execute arbitrary JavaScript in victim browsers via the public product return form. The customer_order_id parameter is reflected without sanitization in error messages when order lookups fail, allowing HTML injection. No public exploit identified at time of analysis. While CVSS 5.3 indicates moderate severity, the unauthenticated attack vector (PR:N) and low complexity (AC:L) make this readily exploitable against any site visitor, though user interaction (UI:P) is required to submit the malicious form.
Technical ContextAI
The vulnerability exists in Vvveb CMS's customer-facing order return functionality, specifically in the error handling logic for failed order lookups. When a user submits the product return form with an invalid order ID, the application constructs an error message by directly concatenating the user-supplied customer_order_id POST parameter into the string 'Order %s not found!' without HTML entity encoding or output escaping. This templated error message is then rendered in the frontend view, allowing injection of arbitrary HTML tags and JavaScript event handlers. This is a classic reflected XSS vulnerability (CWE-79) where untrusted input flows directly to a web page output context without proper sanitization. The affected component appears to be a publicly accessible feature requiring no authentication, making it a broad attack surface. Vvveb CMS is built on PHP and uses a templating system that failed to apply output encoding in this specific error path.
RemediationAI
Upgrade to Vvveb CMS version 1.0.8.3 or later, which contains the fix for this reflected XSS vulnerability. Download the patched version from the official Vvveb GitHub repository and follow standard CMS upgrade procedures including database backup and file replacement. Review the security advisory at https://github.com/givanz/Vvveb/security/advisories/GHSA-3xwm-8f6m-cfc6 for additional upgrade guidance. If immediate patching is not feasible, implement compensating controls: deploy a web application firewall (WAF) with XSS detection rules targeting the customer_order_id parameter in POST requests to the return form endpoint, though this may cause false positives requiring tuning. Additionally, implement Content Security Policy (CSP) headers with script-src 'self' to limit inline JavaScript execution, noting this may break legitimate dynamic features and requires testing. Review application logs for suspicious patterns in customer_order_id submissions containing script tags or event handlers as potential exploitation indicators. These workarounds reduce but do not eliminate risk, making upgrade the definitive solution.
An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. Rated critica
A vulnerability was found in givanz Vvveb 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploi
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute
Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute a
A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 5.5), this vulnerability
A security vulnerability has been detected in givanz Vvveb 1.0.7.2. Rated medium severity (CVSS 5.3), this vulnerability
Remote code execution in Vvveb CMS v1.0.8 allows authenticated administrators to execute arbitrary system commands as ww
Remote code execution in Vvveb CMS versions prior to 1.0.8.1 allows unauthenticated attackers to inject arbitrary PHP co
Hard-coded credentials in Vvveb's Docker deployment expose the entire application database to unauthenticated remote att
Stored cross-site scripting in Vvveb prior to 1.0.8.1 allows authenticated users with media upload and rename permission
Insecure Direct Object Reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated low-privileged Vendor to read, d
Broken object-level authorization in Vvveb CMS prior to 1.0.8.4 allows an authenticated low-privilege Vendor to access,
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today