OpenReception’s appointment booking software contains a stored XSS flaw that lets an administrator embed javascript URLs in tenant link fields. When a patient loads the public landing page, these links are rendered as anchor tags without filtering, allowing anyone who clicks them to execute attacker‑supplied code in the patient’s browser. The injected script runs before client‑side encryption of form data, permitting it to read or modify the plaintext patient inputs, thereby compromising the system’s promise that the server cannot read patient data.

The vulnerability affects all installations of OpenReception Appointment Booking Software versions earlier than 1.0.2. Administrators with tenant‑level privileges can create the malicious links, and patients interacting with the public pages are the target users.

With a CVSS score of 8.1, this flaw presents a high severity risk. No EPSS score is currently available, but the absence of a low exploitation probability threshold indicates that the exploit could occur if the conditions are met. The vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires an attacker who controls tenant link configuration to embed a javascript URL and a patient who clicks the link, which is realistic given the administrative scope and the public nature of the landing page. The attack path therefore involves administrative access to embed the payload and a patient’s interaction with the page. the exploit does not require network access from the attacker beyond the ability to configure tenant links.