# CVE-2026-7296: SourceCodester Pizzafy Ecommerce System XSS in save_order

Source: https://junglewise.ai/threats/cve-2026-7296-sourcecodester-pizzafy-ecommerce-system-xss-in-save-order  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-7296 · Severity: low · CVSS 2.4 · Published 2026-04-28

SourceCodester Pizzafy Ecommerce System 1.0 contains a security flaw in its order processing component. An attacker with administrative access can inject malicious scripts into the 'first_name' field when saving an order. If another user views this data, the script could execute in their browser, potentially leading to unauthorized actions or information disclosure within the application.

Technologies: [SourceCodester Pizzafy Ecommerce System](https://junglewise.ai/threats/technologies/pizzafy-ecommerce-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-7296 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7296 being exploited in the wild.

**How severe is CVE-2026-7296?** Low severity, with a CVSS score of 2.4, published 28 April 2026.

**Which products and versions are affected?** SourceCodester Pizzafy Ecommerce System 1.0.

**Is there a fix for CVE-2026-7296?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7296 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-7296?** Check whether you run SourceCodester Pizzafy Ecommerce System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pizzafy Ecommerce System 1.0. The vulnerability is located in the 'save_order' function within the '/admin/ajax.php' file, specifically triggered by insufficient sanitization of the 'first_name' argument. A remote attacker with high privileges (PR:H) can submit a crafted request containing malicious JavaScript. When an administrator or another user views the saved order details, the payload executes in their browser. This is classified as CWE-79 and CWE-94. A public proof-of-concept (PoC) exists, though no official patch has been confirmed.

## Affected products

- SourceCodester Pizzafy Ecommerce System 1.0

## Timeline

- 2026-04-28: disclosed: Vulnerability disclosed and CVE assigned
- 2026-04-28: advisory: NVD and VulDB published advisory details

## References

- [https://github.com/joaodrmmd/VulDB-Reports/blob/main/XSS%20-%20Orders.pdf](https://github.com/joaodrmmd/VulDB-Reports/blob/main/XSS%20-%20Orders.pdf)
- [https://vuldb.com/submit/803175](https://vuldb.com/submit/803175)
- [https://vuldb.com/vuln/359956](https://vuldb.com/vuln/359956)
- [https://vuldb.com/vuln/359956/cti](https://vuldb.com/vuln/359956/cti)
- [https://www.sourcecodester.com/](https://www.sourcecodester.com/)

## Related threats

- [SourceCodester Pizzafy Ecommerce System unrestricted upload in save_settings](https://junglewise.ai/threats/cve-2026-16226-sourcecodester-pizzafy-ecommerce-system-unrestricted-upload-in)
- [SourceCodester Pizzafy Ecommerce System local file inclusion in index.php](https://junglewise.ai/threats/cve-2026-10559-sourcecodester-pizzafy-ecommerce-system-local-file-inclusion-in)
- [SourceCodester Pizzafy Ecommerce System LFI in admin/index.php](https://junglewise.ai/threats/cve-2026-10558-sourcecodester-pizzafy-ecommerce-system-lfi-in-admin-index-php)
- [SourceCodester Pizzafy Ecommerce System XSS in save_user](https://junglewise.ai/threats/cve-2026-7297-sourcecodester-pizzafy-ecommerce-system-xss-in-save-user)
- [SourceCodester Pizzafy Ecommerce System XSS in save_menu](https://junglewise.ai/threats/cve-2026-7295-sourcecodester-pizzafy-ecommerce-system-xss-in-save-menu)