SourceCodester Photo Share Website 1.0 contains a cross-site scripting vulnerability in an unspecified function of the /social/index.php?page=home file. This vulnerability arises from improper sanitization of the Comment argument, enabling remote attackers to inject and execute arbitrary scripts in the context of the affected web application. The vulnerability has been assigned CVE-2026-19209 and has a CVSS 4.0 base score of 5.1, indicating medium severity. Exploit code has been published, but no active exploitation has been reported. No vendor-provided patch or remediation instructions are currently documented.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users visiting the affected web page, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the medium severity rating and the requirement for user interaction (UI:P).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and output encoding on the Comment parameter to mitigate the risk of XSS. Monitoring for updates from SourceCodester is recommended.