Is CVE-2026-7296 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7296 being exploited in the wild.

How severe is CVE-2026-7296?

Low severity, with a CVSS score of 2.4, published 28 April 2026.

Is there a fix for CVE-2026-7296?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-7296 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-7296?

Check whether you run SourceCodester Pizzafy Ecommerce System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7296: SourceCodester Pizzafy Ecommerce System XSS in save_order

CVE-2026-7296 · Severity: low · CVSS 2.4 · Published 2026-04-28

SourceCodester Pizzafy Ecommerce System 1.0 contains a security flaw in its order processing component. An attacker with administrative access can inject malicious scripts into the 'first_name' field when saving an order. If another user views this data, the script could execute in their browser, potentially leading to unauthorized actions or information disclosure within the application.

Technologies: SourceCodester Pizzafy Ecommerce System. Vendors: SourceCodester.

Quick answers

Is CVE-2026-7296 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7296 being exploited in the wild.
How severe is CVE-2026-7296?: Low severity, with a CVSS score of 2.4, published 28 April 2026.
Which products and versions are affected?: SourceCodester Pizzafy Ecommerce System 1.0.
Is there a fix for CVE-2026-7296?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-7296 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-7296?: Check whether you run SourceCodester Pizzafy Ecommerce System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pizzafy Ecommerce System 1.0. The vulnerability is located in the 'save_order' function within the '/admin/ajax.php' file, specifically triggered by insufficient sanitization of the 'first_name' argument. A remote attacker with high privileges (PR:H) can submit a crafted request containing malicious JavaScript. When an administrator or another user views the saved order details, the payload executes in their browser. This is classified as CWE-79 and CWE-94. A public proof-of-concept (PoC) exists, though no official patch has been confirmed.

Affected products

SourceCodester Pizzafy Ecommerce System 1.0

Timeline

2026-04-28: disclosed: Vulnerability disclosed and CVE assigned
2026-04-28: advisory: NVD and VulDB published advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.