A remote attacker can inject malicious script by manipulating the Title parameter in the /tourism/classes/Master.php?f=save_package endpoint. The vulnerability allows arbitrary client‑side scripting when the title is later rendered in browsers, enabling defacement, credential theft, or session hijacking. It is a typical reflected or stored XSS flaw.

SourceCodester Simple Responsive Tourism Website version 1.0 is affected. The flaw resides in the Master.php handler for the save_package function, where the Title argument is not sanitized before output. Only the 1.0 release was mentioned; no newer releases are referenced in the advisory.

The CVSS base score is 5.3, indicating a moderate impact. EPSS indicates an exploitation probability of less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is remote and the flaw relies on user input, the risk is limited to environments that expose the administration interface to the internet. Nevertheless, the existence of a public exploit means there's a low‑to‑moderate likelihood of an attacker leveraging it in a suitable target.