OpenEMR stores user‑supplied input from Eye Exam forms in patient encounter records. The input is rendered without proper sanitization, allowing an attacker with the Notes‑my‑encounters role to inject arbitrary JavaScript. When other users with the same role view the encounter pages or visit history, the malicious script runs in their browser, potentially hijacking sessions, modifying displayed data, or retrieving sensitive information. This stored XSS flaw is a classic cross‑site scripting weakness that grants the attacker the same privileges as any user of the affected role.

The vulnerability affects the OpenEMR electronic health records application. All installations running a version prior to 8.0.0.3 are vulnerable. In particular, the store function for the Eye Exam form ($CHRONIC2 and $CHRONIC3) lacks output escaping.

The CVSS base score is 8.7, reflecting a high‑impact flaw that is exploitable by an authenticated user. EPSS is under 1 %, indicating that current exploit prevalence is low, and the flaw is not listed in the CISA KEV catalog. Nevertheless, the attack requires only a valid OpenEMR account with the specific form role, meaning that any compromised or legitimate account could be abused. Because the erroneous browser code runs in the victim's context, the attack can be performed silently and widely, so administrators should treat it as a serious risk.