The vulnerability CVE-2026-13554 affects itsourcecode Online Hotel Management System 1.0. It arises from improper input validation of the 'Name' parameter in the POST request to /admin/mod_amenities/controller.php?action=add. This allows an attacker to perform cross-site scripting (XSS) attacks by injecting malicious scripts that execute in the context of the victim's browser. The vulnerability can be exploited remotely without authentication. No official fix or patch has been published as of the data provided.

Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application. This may lead to session hijacking, defacement, or redirection to malicious sites. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor the vendor's communications for updates. In the meantime, applying input validation and output encoding on the 'Name' parameter in the affected POST request handler may mitigate exploitation risk.