The vulnerability is a stored or reflected cross-site scripting flaw that results from unsanitized treatment of the product_name parameter in the Add Product page. An attacker can inject arbitrary JavaScript that will execute in the context of an administrator browsing the page, enabling session hijacking, defacement or authenticated actions.

The flaw exists in the Online Shoe Store 1.0 application, particularly within the /admin/admin_feature.php file, as hosted by the vendor code-projects. No other affected versions are noted, but the component is part of the add-product functionality and is identified only in 1.0.

The CVSS score of 4.8 classifies the issue as medium severity; EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely via a crafted request to the product_name field, and the exploit is publicly documented. While no current exploitation activity is tracked, the public nature of the finding and the remote entry point suggest that future automated attacks may target this flaw.