This vulnerability in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 213babdbaa949e94557246414db0130e01394517 allows remote attackers to perform cross-site scripting (XSS) attacks via manipulation of the User-Agent header. The affected function is checkForPostRequests in application/core/MY_Controller.php within the Subscribed Emails Admin Page component. The product follows a rolling release model, so exact version numbers for affected or patched releases are not provided. A patch with commit ID 23105f25dadf57b4314fc015a63a7c6e910c89df is recommended to remediate the issue. No known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the vulnerable web application by injecting malicious code through the User-Agent header. This can lead to potential session hijacking, defacement, or other client-side attacks. The vulnerability requires no privileges and no user interaction other than visiting a crafted page or sending a crafted request. The CVSS score of 5.3 reflects a medium impact with network attack vector and low complexity.

A patch identified by commit 23105f25dadf57b4314fc015a63a7c6e910c89df is available and should be applied to remediate this vulnerability. Since the product uses a rolling release system, users should update to the latest codebase that includes this patch. No vendor advisory explicitly states that no action is required or that the issue is already mitigated, so applying the patch is recommended.