The vulnerability CVE-2026-13557 affects itsourcecode Online Hotel Management System version 1.0. It arises from improper sanitization of the 'Name' parameter in the POST request handler located in /admin/mod_room/controller.php?action=add. This allows an attacker to inject malicious scripts leading to cross-site scripting (XSS). The vulnerability can be exploited remotely without privileges or user interaction, and exploit code is publicly available. No official patch or remediation has been indicated by the vendor or advisory at this time.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser session. The attack requires no privileges and can be launched remotely. However, the vulnerability is rated medium severity with a CVSS score of 5.3, indicating a moderate impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently provided, users should monitor the vendor's communications for updates. Until a patch is available, consider applying input validation or filtering on the 'Name' parameter at the web application firewall or server level to mitigate exploitation risk.