An attacker who can authenticate to ERPNext can store malicious HTML or JavaScript in a Customer record’s email_id or mobile_no fields, creating a stored client‑side XSS (CWE‑79) flaw. When a POS operator selects that customer, the stored payload is rendered unescaped in the point‑of‑sale interface, allowing client‑side code to execute in the operator’s browser. This can lead to session hijacking, credential theft or defacement of the POS interface but does not grant direct control of the underlying ERPNext server process.

The flaw is present in ERPNext version 16.16.0 on all supported operating systems, including Linux, macOS and Windows.

The vulnerability has a CVSS score of 5.1, indicating moderate risk. The EPSS score is unavailable, and it is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not yet been observed. Because the flaw requires authenticated access, the attacker must have valid user credentials or privileges to modify customer data. Once authenticated, execution is straightforward via the POS front‑end.