CVE-2026-33933
Starting in version 7.0.2.1 and prior to version 8.0.0.3, a reflected cross-site scripting (XSS) vulnerability in the custom template editor allows an attacker to execute arbitrary JavaScript in an authenticated staff member's browser session by sending…
Does this matter?
Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own.
Description
OpenEMR is a free and open source electronic health records and medical practice management application. Starting in version 7.0.2.1 and prior to version 8.0.0.3, a reflected cross-site scripting (XSS) vulnerability in the custom template editor allows an attacker to execute arbitrary JavaScript in an authenticated staff member's browser session by sending them a crafted URL. The attacker does not need an OpenEMR account. Version 8.0.0.3 patches the issue.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.27% probability · 19th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- open-emr/openemr
- Source
- security-advisories@github.com
References
- https://github.com/openemr/openemr/commit/d5c8d49ef19983472b2d7db0dbebd2dac9d6a200Patch
- https://github.com/openemr/openemr/commit/de9b6eb0da574430e8223c014cf4a05b0adc29d8Patch
- https://github.com/openemr/openemr/releases/tag/v8_0_0_3Product
- https://github.com/openemr/openemr/security/advisories/GHSA-9qh7-cfq4-j7c3Exploit, Vendor Advisory
- https://github.com/openemr/openemr/security/advisories/GHSA-9qh7-cfq4-j7c3Exploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.