The vulnerability CVE-2026-19916 affects code-projects Online Food Order System version 1.0. It is a cross-site scripting (XSS) flaw in an unspecified function within the edit_food_items.php file. Manipulating the 'dname' parameter enables injection of malicious scripts, which can be executed remotely. The CVSS 3.1 base score is 5.1, indicating medium severity. No vendor patch or fix is currently available, and the exploit code is publicly accessible.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires low attack complexity and no privileges but does require user interaction. There is no indication of further impact such as server compromise or data exfiltration from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding on the 'dname' parameter to mitigate XSS risks. Monitoring for updates from the vendor is recommended.