Vvveb CMS contains an unauthenticated reflected cross‑site scripting vulnerability in the public product return form. When the customer_order_id POST parameter cannot be matched to a valid order, the value is inserted into an error message that is rendered without HTML escaping. The flaw allows an attacker to embed arbitrary HTML or JavaScript that executes in the browsers of any user who submits the form, potentially hijacking sessions or defacing content. The weakness corresponds to CWE‑79, which focuses on improper neutralization of reflected user input.

The issue affects the Vvveb CMS developed by Givanz. Versions earlier than 1.0.8.3 are vulnerable. The vulnerability is present in the public product return page and the related backend error handling.

The CVSS score is 5.3, indicating a moderate severity. Because the vulnerability is unauthenticated and reflected, any website visitor can be tricked into sending a malicious form submission, meaning the attack vector is client‑side from the frontend. The EPSS score is not available and the CVE is not listed in the CISA KEV catalog, so the likelihood of widespread exploitation is uncertain, but the ability to run arbitrary script on users’ browsers remains a tangible risk.