LibreNMS before version 26.9.0 contains a stored cross‑site scripting flaw in the wireless sensor page. The application echoes sensor description values sourced from SNMP DisplayString fields directly into HTML without escaping. An attacker who can control a monitored device's SNMP agent may inject malicious JavaScript into fields such as AI‑AP‑MIB::aiSSID. When an authenticated user opens the device’s Wireless tab, the script runs in the visitor’s browser, enabling the attacker to hijack the user’s session or perform other client‑side attacks.

The affected product is LibreNMS, all releases prior to 26.9.0. The vulnerability exists in the file includes/html/pages/device/wireless.inc.php and is triggered by sensor description data stored in the database during SNMP discovery.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Likely deployment of the attack requires the attacker to have the ability to write SNMP data to a monitored device and for an authenticated user to view the Wireless page. While not a remote code execution flaw, the stored XSS can be leveraged to hijack sessions, potentially exposing sensitive information if an attacker gains access to authenticated user credentials.