CVE-2026-82700: Cross Site Scripting in code-projects Online Shopping System

This vulnerability affects the code-projects Online Shopping System version 1.0. It is a cross-site scripting (XSS) flaw in the /offersmail.php file's Newsletter Subscription component. Specifically, the email parameter is not properly sanitized, allowing an attacker to inject malicious scripts. The attack can be performed remotely without privileges and requires user interaction. The vulnerability has been publicly disclosed with exploit code available, but no official fix or patch has been announced by the vendor.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, phishing, or other malicious actions. However, the attack requires user interaction and does not grant elevated privileges or direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected Newsletter Subscription functionality or apply input validation and sanitization on the email parameter as a temporary mitigation.