CVE-2026-15532 is a cross-site scripting vulnerability affecting SourceCodester Online Book Store System version 1.0. The issue is due to insufficient input validation or sanitization in the User Management Module when processing the Name/Username parameter. This flaw allows remote attackers to execute arbitrary scripts in the context of the affected application, potentially leading to user interface manipulation or session hijacking. The vulnerability requires user interaction and privileges to exploit, and no vendor-provided fix or mitigation is currently documented.

Successful exploitation of this vulnerability can lead to the execution of malicious scripts in users' browsers, potentially enabling theft of session tokens, defacement, or other client-side attacks. The CVSS score of 4.8 indicates a medium impact, reflecting that the attack vector is network-based with low complexity but requires user interaction and some privileges. There is no indication of direct system compromise or data breach from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding on the affected parameters if possible. Monitoring for suspicious activity related to user input fields may help detect exploitation attempts. No vendor advisory or official patch has been published as of now.