The vulnerability is a stored cross‑site scripting flaw in the Category Name field of the admin panel of the Online Food Ordering System v1.0. The application fails to sanitize or encode user input, allowing an attacker to embed malicious JavaScript that executes automatically when a page that displays the stored category is viewed. This can lead to credential theft, defacement, or execution of arbitrary actions in the victim’s browser context.

The affected product is the SourceCodester Online Food Ordering System version 1.0. The flaw exists only within this version’s Category management module and requires user input in the Category Name field. Administrators or any users with write access to create or update categories can introduce the payload.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not in the CISA KEV catalog, yet because it is stored, it can persist until the injected code is removed and can be triggered for every visitor who renders the category. Based on the description, the likely attack vector is through the Category Management interface, requiring write access to inject the payload and a victim’s browser to execute the code.