The vulnerability CVE-2026-13504 affects code-projects Project Management System version 1.0. It is a cross-site scripting (XSS) flaw located in the /mail.php file within the Mail Compose Page component. The vulnerability allows remote attackers to inject malicious scripts due to improper input handling. The exploit has been publicly disclosed, increasing the risk of exploitation. No official fix or patch has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions that rely on executing unauthorized scripts in a user's browser. The CVSS 4.0 base score of 5.1 indicates a medium severity level with network attack vector, low attack complexity, and requiring low privileges with user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or sanitization controls on the /mail.php component if possible, or restrict access to the affected functionality to trusted users only.