CVE-2026-13499 describes a cross-site scripting vulnerability in the yashpokharna2555 restaurent-management-system. The issue occurs in an unspecified function of login_register.php related to user registration, where the Username parameter is not properly sanitized, allowing remote attackers to inject malicious scripts. The product uses a rolling release model, and no specific affected versions or patches are currently available. The vendor has been notified but has not issued a response or remediation guidance. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability is remotely exploitable without authentication and requires user interaction (UI:P). There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, consider applying input validation or output encoding workarounds if possible to mitigate the risk of XSS in the Username parameter.