The Item history widget in Zabbix 7.0+ and the Plain text widget in Zabbix 6.0 can execute JavaScript that has been injected into the widget’s contents when HTML display is enabled. A malicious script injected from a monitored host that an attacker controls will run in the browser context of any user who views a dashboard containing the widget, allowing that user’s credentials and session to be exploited or arbitrary actions performed. This is a classic cross‑site scripting weakness, classified as CWE‑79.

Zabbix Zabbix is the affected vendor. The vulnerability applies to Zabbix 7.0 and later through the Item history widget and to Zabbix 6.0 via the Plain text widget. The fix is distributed in later releases noted by the vendor’s support channel.

The CVSS base score of 7.3 indicates high severity, while the EPSS score is not available but the issue is not currently listed in the CISA KEV catalog. The likely attack vector is injection of malicious JavaScript via a host that feeds data into these widgets; the attacker must control the host data source and a user must open the affected dashboard for the exploitation to succeed. Given the moderate to high severity and lack of an immediate exploit discovered, the risk remains significant for organizations that use these widgets and have exposed interfaces for host data.