This vulnerability affects code-projects Online Shopping System 1.0. It involves improper sanitization or validation of the 'email' parameter in the offersmail.php file, allowing an attacker to inject malicious scripts (cross-site scripting). The attack vector is remote with no privileges required, but user interaction is necessary to trigger the exploit. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No official patch or remediation guidance is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. However, the vulnerability requires user interaction and does not grant direct system access or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding on the 'email' parameter. Monitoring for suspicious activity related to this vulnerability is advised.