OpenEMR contains a stored cross‑site scripting vulnerability that allows a patient portal user to embed arbitrary JavaScript into the payment submission data. The malicious payload is stored through portal/lib/paylib.php and is later rendered by portal/portal_payment.php without escaping, causing the script to run in the browsers of staff members who inspect payment records. This flaw permits the execution of attacker‑supplied code within the context of a staff member’s session.

The affected product is OpenEMR, an open‑source electronic health records system, from the openemr vendor. Versions released before 8.0.0.2 are vulnerable, while 8.0.0.2 and later include the fix.

The vulnerability receives a CVSS score of 8.7, classifying it as high severity. The EPSS score is below 1 %, indicating a low current likelihood of exploitation. It is not listed within the CISA KEV catalog. Exploitation requires a patient portal user to submit a payment containing the malicious payload; when a staff member later views that payment, the embedded script executes in their browser. Monitoring for unusual payment entries or restricting payment submissions may mitigate the risk until the patch is applied.