A cross-site scripting (XSS) vulnerability exists in code-projects Simple Cafe Ordering System 1.0 in the /add_to_cart component. Manipulating the product_name argument can trigger this vulnerability remotely. Public exploit code is available, but the impact is limited to low severity with no confidentiality or availability impact.