CVE-2026-13554 is a medium-severity cross-site scripting vulnerability affecting itsourcecode Online Hotel Management System version 1.0. The issue arises from improper sanitization of the 'Name' parameter in the POST request to /admin/mod_amenities/controller.php?action=add. An attacker can remotely inject malicious scripts via this parameter, potentially leading to script execution in the context of the victim's browser. The vulnerability requires user interaction (UI:P) and has a CVSS 4.0 base score of 5.3. No official fix or patch is currently available, and the exploit details have been publicly disclosed.

Successful exploitation of this vulnerability allows an attacker to perform cross-site scripting attacks by injecting malicious scripts into the vulnerable parameter. This can lead to session hijacking, defacement, or other malicious actions executed in the context of the victim's browser. However, the attack requires user interaction and does not require privileges or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply input validation and sanitization on the 'Name' parameter if possible, and consider restricting access to the affected functionality. Monitoring for suspicious activity related to this endpoint is advisable.