A vulnerability in OpenEMR before 8.3.0 allows an authenticated user with CAMOS privileges to inject arbitrary HTML content that is stored in the system and later rendered without encoding when the content is printed via the non‑print_html branch of rx_print.php. The injected script executes in the victim’s browser context and can perform actions or read data as the victim, meeting the definition of a stored cross‑site scripting flaw. Attackers can use the script to hijack sessions, exfiltrate data, or manipulate the application state for the victim user.

The affected product is OpenEMR, version prior to 8.3.0. The flaw is exploitable on any installation of this software where users possess CAMOS access. No additional product or version details are listed beyond the vendor and product name.

The CVSS score of 9.3 categorizes this issue as Critical. While an EPSS score is not available, the lack of listed exploitation in CISA KEV and absence of publicly documented active exploitation suggest moderate to low current exploit activity. The likely attack vector is authenticated, privileged CAMOS users who can add or modify content, and the vulnerability can only be triggered when the content is later accessed via the print functionality. An attacker needs only an authenticated session and the ability to use the print feature to trigger the stored script.