This vulnerability affects SourceCodester Pizzafy Ecommerce System 1.0, specifically the save_order function in /admin/ajax.php?action=save_order. By manipulating the first_name parameter, an attacker can perform cross-site scripting (XSS) attacks. The vulnerability allows remote exploitation without requiring user interaction or privileges beyond high privileges (PR:H). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, partial user interaction, and low impact on integrity. No official fix or patch has been published as of the data provided.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions within the scope of the affected system. However, the impact is considered medium severity and the integrity impact is low. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should consider applying input validation or sanitization on the first_name parameter as a temporary mitigation. Monitoring for unusual activity related to this endpoint is advisable until an official fix is released.