Exrick xmall up to commit 19e7917d5ed3bd2a2421a3a246ad494c133ba94c contains a cross-site scripting vulnerability in the order-print.jsp file within the order printing component. This vulnerability arises from improper input handling in an unknown function, allowing remote attackers to inject malicious scripts. The product follows a rolling release approach, and no explicit version numbers for affected or patched releases are available. The vendor has been notified but has not provided a response or patch. The CVSS 3.1 base score is 4.3, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability allows remote attackers to perform cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the affected application. This can result in limited integrity impact but does not affect confidentiality or availability. No known exploits are reported in the wild.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is provided, caution should be exercised when handling inputs related to order printing functionality to reduce exposure to XSS attacks.