SourceCodester Pizzafy Ecommerce System 1.0 contains a cross-site scripting vulnerability in the save_user function located at /admin/ajax.php?action=save_user. Manipulation of the Name argument can lead to XSS, allowing remote attackers to execute arbitrary scripts in the context of the affected application. The vulnerability requires high privileges and user interaction to exploit, as indicated by the CVSS vector. No official patch or vendor advisory is currently available to address this issue.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary scripts within the context of the affected application, potentially leading to session hijacking, defacement, or other malicious actions. However, the attack requires user interaction and elevated privileges, which limits the impact severity to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider implementing input validation or sanitization on the Name parameter as a temporary mitigation.