This vulnerability (CVE-2026-7089) affects code-projects Home Service System 1.0, specifically in the Appointment Booking component's /booking.php file. An attacker can manipulate the fname or lname parameters to inject malicious scripts, resulting in a cross-site scripting (XSS) condition. The vulnerability is remotely exploitable without privileges and requires user interaction. The CVSS 4.0 base score is 5.3, indicating medium severity. No official remediation or patch is currently documented.

Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application for users who interact with the malicious input. This may lead to session hijacking, defacement, or other client-side attacks. However, the vulnerability requires user interaction and does not escalate privileges or compromise server-side components directly. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the fname and lname parameters in the /booking.php component to mitigate the risk. Monitoring for updates from the vendor or security advisories is recommended.