OpenEMR stores questionnaire answers. Prior to version 8.0.0, any user who holds the Forms administration role can enter data into these answers. The application displays those answers on encounter and visit‑history pages without sanitizing the content, so a malicious payload entered by that role is rendered as script and executed in the browsers of any other user who views the page. This flaw is a stored XSS, classified as CWE‑79, and provides an attacker with the role the ability to run arbitrary JavaScript in victims’ browsers.

All OpenEMR installations older than version 8.0.0 are affected. The flaw resides in the core code that renders questionnaire answers and applies only to users entitled to the Forms administration role. No specific sub‑module is listed as affected, and the vendor is OpenEMR.

The CVSS score of 7.2 indicates a medium‑high impact. The EPSS score of less than 1 % suggests a low probability of public exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated with the Forms administration role to insert malicious content; once stored, any user with the same role who views the page will have the script executed, creating a risk that depends on the number of users with that role.