OpenEMR contains a stored cross‑site scripting flaw in its prescription CSS/HTML multi‑print feature. Malicious JavaScript can be injected via patient demographic fields, which are rendered without encoding when a prescription is printed. The injected script runs in the context of a clinician’s authenticated session, allowing the attacker to steal CSRF tokens, session data, and perform actions with the clinician’s privileges.

This vulnerability affects all OpenEMR installations that are earlier than version 8.0.0.1. The flaw resides in the multiprintcss_header() function used by the prescription print view, and the patient data can be altered through the PUT api/patient/:num endpoint, bypassing the intended audit review workflow.

The CVSS score of 7.7 indicates high severity. Although EPSS data is not available, the issue is not listed in CISA KEV, suggesting limited active exploitation, but the attack vector is straightforward: a patient portal user injects malicious code, which then executes when a clinician opens a prescription print view. Because the code runs within the clinician’s session, the attacker can access tokens and impersonate the clinician, achieving a high‑impact compromise of confidentiality and integrity.