The vulnerability is a reflected Cross‑Site Scripting flaw located in the demo version of the Cradle eCommerce platform. User‑controlled data entered via the /product/ endpoint is incorporated into the HTML response without proper sanitization, allowing an attacker to inject and execute arbitrary JavaScript code in the browser context of anyone who visits the affected page. This could enable session hijacking, credential theft, or the execution of malicious scripts with the privileges of the compromised user.

The Cradle eCommerce platform is affected; the issue specifically targets the demo installation that ships with the product. No exact version numbers are listed in the advisory, so any deployment that includes the unpatched demo code is considered vulnerable.

The CVSS rating of 5.1 places the vulnerability in the medium severity range. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting a lower public exploitation likelihood at present. Attackers would need to lure users to the vulnerable /product/ page, and exploitation would be limited to scripts run within the victim’s browser. Nonetheless, because it permits arbitrary JavaScript execution, the potential impact on confidentiality, integrity, and availability of user sessions is significant.