The vulnerability is a stored cross‑site scripting flaw that allows attackers to embed malicious JavaScript into web pages rendered by Akıllı Ticaret Software Technologies Ltd.’s E‑Commerce Pack. Stored XSS can be used to steal user credentials, hijack sessions, or deface the site after the input is persistently saved and displayed. The weakness is a failure to neutralize user‑supplied data before inclusion in a page, aligned with CWE-79.

Affected is the Akıllı Ticaret E‑Commerce Pack from version 4.5.001 through 28082026. Users operating any unattended instance within that range are potentially vulnerable.

The CVSS score of 5.4 indicates a moderate severity. EPSS is not available, so no quantified exploit probability can be asserted. The security advisory is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need to supply malicious input via legitimate site interfaces to trigger the stored script. Once injected, the script executes with the victim’s browser privileges, enabling credential theft or further compromise.