This vulnerability in SourceCodester Pizzafy Ecommerce System 1.0 allows remote attackers to perform cross-site scripting via manipulation of the 'Name' parameter in the save_settings function located in /admin/index.php?page=save_settings. The flaw enables injection of malicious scripts that could be executed in the context of an authenticated administrator user, as the vulnerability requires privileges (PR:H) and user interaction (UI:P). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required to initiate the attack but high privileges needed to exploit, and partial impact on integrity and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of an authenticated administrator, potentially leading to session hijacking, defacement, or other malicious actions within the admin interface. However, the attack requires high privileges and user interaction, limiting the ease of exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, administrators should restrict access to the affected functionality to trusted users only and consider implementing web application firewall (WAF) rules to detect and block suspicious input targeting the 'Name' parameter. Monitor vendor channels for updates or patches addressing this vulnerability.