A stored cross‑site scripting vulnerability exists in the Pi‑hole Admin Interface. When a user expands a query row, the formatInfo() function renders unescaped data from the upstream, client IP, and ede.text fields into the page. The payload is stored and is displayed when the row is expanded. JavaScript execution is blocked by the server's CSP (script‑src 'self'), so direct script execution is precluded. The impact is therefore limited to malicious HTML content being displayed, which could include visual defacement or other non‑executing malicious content.

Pi‑hole Web Interface versions 6.0 through 6.4 are affected. The issue is fixed in version 6.5 and later.

The CVSS score of 3.1 indicates low severity. The EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the KEV catalog. The attack vector is inferred to require an attacker who can inject arbitrary data into the query logs, such as via upstream traffic or client IP, before a user expands the row. Because the content is stored and the CSP blocks script execution, the risk is moderate and exploitation is unlikely in typical deployments, but the presence of unsanitized HTML could still affect the UI experience.