A cross-site scripting (XSS) vulnerability exists in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to version 4.0. The flaw is due to improper handling of the Search argument in the /dashboard/Ccustomer/manage_customer file. This vulnerability can be exploited remotely but requires user interaction and privileges. The vendor has not provided a response or patch. Public exploit code is available.