An OTRS administrator can embed arbitrary JavaScript into a Custom Page's content. The script is persisted by OTRS and executed in any browser that loads the page, creating a stored cross‑site scripting flaw (CWE‑79). This allows an attacker controlling the Custom Page to run code in the browsers of all users who view it, potentially stealing credentials or performing client‑side attacks.

The vulnerability affects OTRS from OTRS GmbH (former OTRS AG). Affected releases include OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and all 2026.X builds prior to 2026.7.X.

The CVSS score of 4.8 classifies this flaw as moderate. EPSS data is not available and the issue is not listed in CISA KEV, indicating no public exploits have been observed yet. However, because the vulnerability requires administrative access to create or edit a Custom Page, the likely attack vector is a trusted or compromised administrator who can inject malicious JavaScript, which will then be executed in the browsers of all users who visit the page. Prompt remediation is recommended.