A Cross Site Scripting (XSS) vulnerability exists in RafyMrX TOKO-ONLINE-ROTI version 1.0, specifically in the detail_produk.php component. This flaw allows a remote attacker to execute arbitrary code by injecting malicious scripts. The vulnerability has a CVSS score of 6.1, indicating a medium severity level.