A stored cross‑site scripting flaw resides in a profile field that is rendered unescaped within portal pages. An attacker with low privileges can insert malicious script into this field, and whenever an administrator views the affected page the script runs in the admin’s browser. This can lead to compromise of the administrator account and further privileges.

The vulnerability affects FRAPPE ERPNext versions prior to 15.113.0 and all 16.x releases before 16.24.0. Upgrading to 15.113.0 or later, or to 16.24.0 or later, removes the flaw.

The CVSS score of 8.5 classifies the issue as high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires the attacker to have the ability to write to a profile field and for an administrator to view the portal page, so the vector is inferred to be local via user interaction with the portal. Given the lack of publicly disclosed exploits, the threat remains theoretical but significant due to the ease of injection and the high impact of compromising an administrator.