A cross‑site scripting flaw exists in the admin_football.php module of code‑projects Online Shoe Store 1.0. An attacker can supply a crafted value for the product_name parameter. When the application renders the supplied value without proper filtering, arbitrary JavaScript is executed in the browser of anyone who views the affected page. This allows an attacker to steal session cookies, deface the site, or conduct phishing attacks. The flaw is classified as CWE‑79 and is also linked with possible code‑injection weaknesses (CWE‑94).

The affected product is code‑projects Online Shoe Store 1.0. The vulnerability resides in the /admin/admin_football.php file, and administrators or users who can interact with this page via the product_name argument are susceptible. No information about additional authentication requirements is provided, so the issue may be exploitable by anyone who can reach the page.

With a CVSS score of 4.8, the vulnerability is considered moderate; the probability of exploitation is not quantified by EPSS and it is not listed in the CISA KEV catalog. Nevertheless, because a public exploit has been released and the attack can be carried out remotely, administrators should treat this as a high‑impact risk. The flaw can be leveraged by an unauthenticated attacker to deliver malicious scripts to unsuspecting users.