A stored cross‑site scripting vulnerability exists in the component that renders answers to the Eye Exam form in OpenEMR. When an authenticated user possessing the Notes‑my‑encounters role submits input containing malicious JavaScript to the form, that payload is stored and later displayed verbatim on the patient encounter page and in the visit history. This flaw, classified as CWE‑79, enables execution of arbitrary script in the browsers of any other user who has the same form role and views the affected pages, potentially leading to session theft, data leakage, or further compromise of the system.

The issue affects OpenEMR applications running versions earlier than 8.0.0.2. Users who can fill Eye Exam forms under the Notes‑my‑encounters role are both the potential attackers and victims, as malicious content is stored and rendered for anyone with that role who views the encounter or history pages.

The CVSS base score of 8.5 marks this vulnerability as high. The EPSS score of less than 1% indicates that active exploitation is currently unlikely, and it is not listed in CISA’s KEV catalog. Nonetheless, an attacker must be authenticated and possess the relevant role; thereafter the attack can be carried out simply by submitting malicious form data and relying on other users to view the content. The exploit path is straightforward and does not require additional system access beyond the existing role permissions.