OpenEMR versions before 8.0.0.2 allow an authenticated user who can write encounter forms to store data that, when a clinician uses the search feature on the Custom Report page, is reconstructed as raw HTML by the SearchHighlight plugin and passes it to jQuery’s $ constructor. This process executes embedded JavaScript in the victim’s browser, giving the attacker the ability to run scripts with the victim’s privileges. The description does not specify any additional capabilities beyond script execution.

All OpenEMR releases prior to 8.0.0.2 are affected. The vulnerability requires an authenticated user with encounter form write permission and a victim who uses the Custom Report search function. The issue is isolated to the SearchHighlight.js plugin within the OpenEMR application.

The CVSS base score of 4.4 indicates low severity. EPSS is below 1%, suggesting exploitation is unlikely. The vulnerability is not listed in the KEV catalog. Based on the description, the likely attack vector involves the Custom Report search feature accessed by an authenticated user, and the impact is confined to client‑side script execution within the same OpenEMR instance. No information is provided about further consequences such as data exfiltration or privilege escalation, so those aspects remain unspecified.