A stored cross‑site scripting vulnerability exists in the offersmail.php file of the Online Shopping System. When a user submits an email address, the value is stored without proper sanitization, allowing an attacker to inject malicious script that runs in the browsers of anyone who views the affected page or receives the subscription email. This flaw enables the attacker to steal session cookies, deface content, or redirect users to phishing sites. Additionally, the listing of CWE‑94 suggests potential code injection capabilities when rendering the stored data, increasing the risk of further exploitation. The malicious payload does not require local access and can be triggered remotely by simply crafting a subscription request with a malicious email address.

The vulnerability affects code‑projects Online Shopping System version 1.0. No other downstream product versions or patches are documented. Users running this version of the Shopping System, particularly the Newsletter Subscription module, are at risk.

The CVSS score of 5.3 indicates a moderate severity vulnerability. Although the EPSS score is unavailable, the public release of an exploit and the ability to trigger the attack from a remote source suggest a realistic threat of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can abuse the flaw by sending crafted requests to the offersmail.php endpoint from any internet‑connected device, leveraging the stored XSS to compromise victim browsers.