TechStore 1.0 contains a reflected cross‑site scripting flaw in the contact_display feature, where an attacker can supply a crafted id parameter that is echoed directly into the rendered page. The unsanitized input permits the injection of JavaScript code that will run with the privileges of any user viewing the page, potentially allowing theft of session cookies, credential replay, or redirection to malicious sites.

The vulnerability is limited to the TechStore 1.0 web application. No other versions or vendor products are listed, and no detailed version ranges are provided in this advisory.

The CVSS score of 6.1 classifies this flaw as moderate severity, and the EPSS score of <1% indicates a low probability of exploitation. However, because the vulnerability is triggered by a simple crafted HTTP request with no authentication, an attacker can still exploit it easily once it is discovered. The impact on confidentiality, integrity, and availability remains significant, allowing arbitrary JavaScript execution in the victim’s browser. The flaw is not listed in the CISA KEV catalog, but the fault remains unmitigated until a vendor update or remediation is applied.