CVE-2021-32573

CVE-2021-32573 describes a Reflected Cross-Site Scripting (XSS) vulnerability in the express-cart package, versions through 1.1.10, for Node.js, specifically affecting user input fields for product options. The vulnerability has a CVSS score of 4.8 (Medium), indicating that an attacker with high privileges could exploit it with low attack complexity, requiring user interaction, to achieve low impact on confidentiality and integrity. While the vendor notes exploitation would require an administrator to "hack his/her own website," there is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.