# CVE-2026-7297: SourceCodester Pizzafy Ecommerce System XSS in save_user

Source: https://junglewise.ai/threats/cve-2026-7297-sourcecodester-pizzafy-ecommerce-system-xss-in-save-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-28. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-7297 · Severity: low · CVSS 2.4 · Published 2026-04-28

SourceCodester Pizzafy Ecommerce System 1.0 is an online platform for managing pizza sales. A security flaw in the user management section allows an attacker with administrative access to inject malicious scripts into the system. If another user views the affected page, these scripts could execute in their browser, potentially leading to unauthorized actions or data theft within the application.

Technologies: [SourceCodester Pizzafy Ecommerce System](https://junglewise.ai/threats/technologies/pizzafy-ecommerce-system). Vendors: [SourceCodester](https://junglewise.ai/threats/vendors/sourcecodester).

## Quick answers

**Is CVE-2026-7297 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7297 being exploited in the wild.

**How severe is CVE-2026-7297?** Low severity, with a CVSS score of 2.4, published 28 April 2026.

**Which products and versions are affected?** SourceCodester Pizzafy Ecommerce System 1.0.

**Is there a fix for CVE-2026-7297?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7297 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-7297?** Check whether you run SourceCodester Pizzafy Ecommerce System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pizzafy Ecommerce System 1.0 within the save_user function of /admin/ajax.php. The vulnerability is triggered by insufficient sanitization of the 'Name' argument when the action is set to 'save_user'. A remote attacker with high privileges (PR:H) can inject malicious JavaScript that executes when other users (typically administrators) interact with the user management interface. This requires user interaction (UI:R) to trigger the payload. While the CVSS score is low due to the high privilege requirement, the exploit code has been publicly disclosed.

## Affected products

- SourceCodester Pizzafy Ecommerce System 1.0

## Timeline

- 2026-04-28: disclosed: Vulnerability disclosed and CVE assigned.
- 2026-04-28: advisory: Initial publication by VulDB/NVD.

## References

- [https://github.com/joaodrmmd/VulDB-Reports/blob/main/XSS%20-%20Users.pdf](https://github.com/joaodrmmd/VulDB-Reports/blob/main/XSS%20-%20Users.pdf)
- [https://vuldb.com/submit/803176](https://vuldb.com/submit/803176)
- [https://vuldb.com/vuln/359957](https://vuldb.com/vuln/359957)
- [https://vuldb.com/vuln/359957/cti](https://vuldb.com/vuln/359957/cti)
- [https://www.sourcecodester.com/](https://www.sourcecodester.com/)

## Related threats

- [SourceCodester Pizzafy Ecommerce System unrestricted upload in save_settings](https://junglewise.ai/threats/cve-2026-16226-sourcecodester-pizzafy-ecommerce-system-unrestricted-upload-in)
- [SourceCodester Pizzafy Ecommerce System local file inclusion in index.php](https://junglewise.ai/threats/cve-2026-10559-sourcecodester-pizzafy-ecommerce-system-local-file-inclusion-in)
- [SourceCodester Pizzafy Ecommerce System LFI in admin/index.php](https://junglewise.ai/threats/cve-2026-10558-sourcecodester-pizzafy-ecommerce-system-lfi-in-admin-index-php)
- [SourceCodester Pizzafy Ecommerce System XSS in save_order](https://junglewise.ai/threats/cve-2026-7296-sourcecodester-pizzafy-ecommerce-system-xss-in-save-order)
- [SourceCodester Pizzafy Ecommerce System XSS in save_menu](https://junglewise.ai/threats/cve-2026-7295-sourcecodester-pizzafy-ecommerce-system-xss-in-save-menu)