FreeScout versions 1.8.208 and earlier store incoming email bodies in the database without sanitization and later render them unescaped in outgoing email notifications using Blade’s raw output syntax {!! $thread->body !!}. This creates a stored Cross‑Site Scripting vulnerability that allows an attacker to inject arbitrary HTML and, if executed by an email client that supports JavaScript, to run scripts that could hijack sessions or steal credentials. The weakness is identified as CWE‑116 and CWE‑79.

The affected product is FreeScout, a PHP‑based help desk and shared inbox platform developed by freescout‑help‑desk. Versions 1.8.208 and below are vulnerable; the issue is addressed in 1.8.209 and later. The flaw exists in the email template rendering path that processes incoming messages and inserts the raw body into outgoing notification emails. All agents, administrators, and any user who views the generated notification are potentially exposed to the malicious content.

The CVSS score of 9.3 classifies this flaw as critical. Although the EPSS score is below 1%, indicating a low current exploitation likelihood, the vulnerability is not listed in the CISA KEV catalog. An attacker does not require authentication to exploit the flaw—they can send a malicious email that is stored unchanged, and when any subscribed user opens the resulting notification email, the embedded content is rendered. This simplicity and lack of prerequisite make the attack straightforward in a typical deployment. Administrators should prioritize applying the fix to remove the risk entirely.