TechStore 1.0 contains a reflected cross‑site scripting flaw in the contact_display feature, where an attacker can supply a crafted id parameter that is echoed directly into the rendered page. The unsanitized input permits the injection of JavaScript code that will run with the privileges of any user viewing the page, potentially allowing theft of session cookies, credential replay, or redirection to malicious sites.

The vulnerability is limited to the TechStore 1.0 web application. No other versions or vendor products are listed, and no detailed version ranges are provided in this advisory.

No EPSS score is available, but the CVE remains high risk because the attack requires only a crafted HTTP request containing a malicious id value. An attacker can exploit this without authentication, and the impact on confidentiality, integrity, and availability is significant. The CVE is not currently listed in the CISA KEV catalog, but the fault remains unmitigated until a vendor update or remediation is applied.