This vulnerability is a stored cross‑site scripting flaw in the save_order operation of the Pizzafy Ecommerce System. An attacker can supply a crafted first_name value that is later rendered in the browser without proper encoding, allowing arbitrary script execution. This can be used to hijack sessions, steal credentials, or deface the site, affecting the confidentiality and integrity of the user’s session data.

SourceCodester Pizzafy Ecommerce System version 1.0 running the admin/ajax.php handler for the save_order action is affected. No other versions or products are listed as impacted.

With a CVSS score of 4.8 and no EPSS information, the risk is moderate but tangible. The vulnerability can be exploited remotely and a public exploit exists, though it is not yet catalogued in CISA KEV. The attack is likely performed via a crafted request to the save_order endpoint, requiring the attacker to supply a malicious first_name parameter.