The vulnerability is a stored cross‑site scripting flaw in public portal forms of Frappe ERPNext. Unauthenticated users can submit offensive markup that the system stores and later renders to staff during record review. Upon viewing, the injected script executes in the staff member’s browser, potentially allowing the attacker to hijack sessions or steal information from the staff context.

This flaw affects Frappe ERPNext versions before 15.112.0 and all 16.x releases before 16.23.0. The vulnerability is present in the public portal form handling code and is relevant to deployments that expose the portal to unauthenticated users.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by submitting crafted content through the public portal form without authentication. The compromised code will run only in the browsers of staff reviewing the stored record, so exploitation requires a victim user to open the infected record after an attacker has posted the payload. The risk is primarily to the confidentiality and integrity of the staff session context.