The vulnerability resides in the /app/sms.php file of Projectworlds House Rental and Property Listing 1.0, where the Message argument is not properly sanitized. Injection of malicious script into that argument triggers client‑side code execution in a victim’s browser. Attacks can proceed remotely via HTTP requests, potentially allowing an adversary to steal session cookies, deface pages, or execute arbitrary payloads in the context of an authenticated user.

The only documented affected product is Projectworlds House Rental and Property Listing 1.0, supplied by the vendor Projectworlds. No other versions or products are listed in the CNA data.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is reported as less than 1%, meaning the known exploitation probability is very low, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is exploitable remotely, an attacker only needs to send a crafted HTTP request to the vulnerable endpoint; no local privileges are required. The lack of a public exploit URL in the provided data suggests that, while the capability exists, current exploitation activity in the wild is minimal.