The vulnerability CVE-2026-4899 affects the Online Food Ordering System 1.0 by code-projects. It is a cross-site scripting flaw in the /dbfood/food.php file caused by improper sanitization of the 'cuisines' parameter. An attacker can remotely inject malicious scripts that execute in the context of a victim's browser when the crafted input is processed. The vulnerability requires user interaction and does not require privileges or authentication. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, partial user interaction, and low impact on integrity.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The impact on confidentiality and availability is not indicated. The medium severity reflects moderate risk due to the need for user interaction and limited impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the 'cuisines' parameter to mitigate XSS risks. Monitoring for updates from the vendor is recommended.