The vulnerability is a reflected Cross‑Site Scripting (XSS) flaw in the /collection/ endpoint of the Cradle eCommerce demo. User input is insecurely reflected in the resulting HTML, allowing an attacker to inject and execute arbitrary JavaScript on the victim’s browser. This injection can lead to session hijacking, defacement or phishing attacks, effectively giving the attacker the ability to run client‑side code while the legitimate user is authenticated or browsing the site. The weakness is identified as CWE‑79.

The affected product is Cradle eCommerce, specifically the demo version that includes the /collection/ endpoint. The vendor/product list indicates e-commerce:Cradle; no specific version is listed, so any installation using the demo "/collection/" feature before the latest update is potentially vulnerable.

The CVSS score of 5.1 indicates medium severity. The EPSS score is unavailable, suggesting no public reports yet. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote via crafted URLs that a victim is prompted to follow. Because it is a reflected XSS, it requires the victim to visit the malicious URL; it does not require special local privileges. If a user visits the crafted link, the injected script runs in the context of the Cradle domain, giving the attacker client‑side execution capabilities.