CVE-2026-45622 is a reflected XSS vulnerability in givanz Vvveb CMS before version 1.0.8.3. The vulnerability occurs in the public product return form where the customer_order_id POST parameter is embedded into an error message ('Order %s not found!') without HTML escaping. This allows an attacker to inject malicious HTML or JavaScript that executes in the context of the submitting user's browser. The flaw is unauthenticated and exploitable remotely. The issue is resolved by updating to version 1.0.8.3.

Successful exploitation allows an attacker to execute arbitrary HTML or JavaScript in the victim's browser when they submit the product return form with a crafted customer_order_id. This can lead to typical reflected XSS impacts such as session hijacking, phishing, or browser-based attacks. The vulnerability does not require authentication and affects all users who interact with the vulnerable form. There are no known exploits in the wild at this time.

Upgrade Vvveb CMS to version 1.0.8.3 or later, where this reflected XSS vulnerability is fixed. No other official remediation or temporary fixes are documented. Until the update is applied, avoid exposing the vulnerable product return form to untrusted users or implement input validation and output encoding as a temporary measure.