A stored XSS vulnerability was discovered in osTicket 1.18.3 caused by inadequate sanitization of the thread entry title field. The subject line supplied by a user is saved to the database unchanged and later rendered within multiple staff‑facing templates without proper HTML escaping. This allows an attacker to embed malicious JavaScript that will execute in the browser of any staff member who views the affected ticket thread.

osTicket version 1.18.3 is affected. Any installation that accepts ticket replies or email submissions with a custom subject line is at risk. The vulnerability manifests in staff templates such as reply‑expand.tmpl.php, thread‑entries.tmpl.php and thread‑entry.tmpl.php where the title field is output directly.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score is less than 1% and the issue is not listed in the CISA KEV catalog, suggesting no widespread exploits yet. The flaw is trivially exploitable because any user able to submit a ticket reply or email can trigger it. The injected script runs in the context of the staff browser when a ticket thread is viewed, which can compromise the integrity of the staff session and allow client‑side code execution.