The vulnerability is a stored cross‑site scripting flaw in the Frappe dashboard chart filter functionality. Because jQuery renders entered filter values as rich text, an attacker with system authentication can store malicious filter values that will execute scripts in the web browsers of users who view the affected dashboard chart. This is a CWE-79 vulnerability.

The flaw impacts Frappe applications on any branch older than 15.118.0 and on 16.x releases before 16.31.0. Users and administrators of those versions who can configure dashboard charts are at risk. The library named "frappe" on the Frappe platform is the affected product.

The CVSS score of 5.1 indicates moderate severity. No EPSS score is available, so the likelihood of current exploitation cannot be quantified. The flaw is not listed in the CISA KEV catalog. Attackers must first authenticate to the system; once authenticated, they can embed and store arbitrary scripts that will run in the browsers of any other user who accesses the same dashboard chart. The impact is limited to client‑side execution in the user’s browser and does not provide remote code execution on the server.