A flaw in the Customer-Registration Notification Email component allows remote attackers to perform basic cross site scripting (XSS), a technique where malicious scripts are injected into trusted websites. The issue exists within an unknown function of the `/customer/register` file and is triggered by manipulating the `first name` and `last name` variables.