This vulnerability in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 49b20f53de2b7ec34e920b11c863f1491d911a04 allows remote attackers to perform cross-site scripting by manipulating the title or description arguments in the hidden REST API endpoint /index.php/api/product/set. The product's rolling release model prevents precise version identification for affected or fixed releases. A patch identified by commit d9785f995da77bdc62fb2d34bad5f7a162c9ad23 is recommended to remediate the issue. No official remediation level or vendor advisory is provided, and no known exploits are reported in the wild.

Successful exploitation enables an attacker to execute arbitrary scripts in the context of users interacting with the vulnerable API endpoint, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability is remotely exploitable without authentication and requires user interaction (UI:P). The CVSS 4.0 score of 5.3 reflects a medium severity impact with low complexity and no privileges required.

A patch has been recommended (commit d9785f995da77bdc62fb2d34bad5f7a162c9ad23) to fix this vulnerability. However, no official vendor advisory or confirmation of patch availability is provided. Users should apply the recommended patch as soon as possible. Patch status is not yet confirmed — check the vendor advisory or repository for current remediation guidance.