This vulnerability in code-projects Online Shoe Store 1.0 allows remote attackers to perform cross-site scripting by manipulating the product_name argument in the /admin/admin_product.php file. The CVSS 4.8 score reflects a medium severity with network attack vector, low attack complexity, no privileges required for attack initiation but user interaction needed, and limited impact on integrity and availability. No vendor-provided patch or mitigation details are available at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the attack requires user interaction and high privileges, limiting the scope of impact. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the affected admin interface and validate or sanitize input parameters such as product_name to mitigate XSS risks.