A low-severity cross-site scripting (XSS) vulnerability exists in the Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to version 20250320. The flaw is in an unspecified function within the /edit_profile file, where manipulation of the first_name or last_name parameters can trigger basic XSS. The vulnerability can be exploited remotely and requires user interaction. The vendor has not responded to disclosure attempts, and no patch is currently available. Public exploit code exists.