A reflected Cross-Site Scripting (XSS) vulnerability exists in the latest demo version of the Cradle eCommerce platform. The vulnerability occurs because user input is insecurely reflected in the HTML output at the /product/ endpoint. Successful exploitation allows an attacker to execute arbitrary JavaScript code in the context of the victim's browser.