Open Source Point of Sale contains a stored XSS flaw in the customer_name column of the Daily Sales management table. The column is rendered without escaping, so an attacker who has customer‑management privileges can insert JavaScript into a customer's first or last name. When any user opens the Daily Sales page, the malicious script runs in that user’s browser, enabling actions such as session hijacking, data theft, or page defacement. The vulnerability is client‑side only; it does not provide direct server‑side code execution.

The affected product is Open Source Point of Sale from the opensourcepos vendor. Versions older than 3.4.3 contain the flaw; the issue was fixed in release 3.4.3 and later.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to possess customer‑management permissions, which implies a privileged or compromised account. Once the conditions are met, the attack can execute arbitrary client‑side scripts, but it does not allow direct compromise of the server or other users’ accounts beyond the vulnerable session.