A Cross‑Site Scripting flaw allows a remote attacker to inject arbitrary JavaScript through a crafted DNS TXT record that the DNS resolution component in oPanel processes. The injected script runs in the context of the user’s browser, enabling the attacker to hijack user sessions and potentially execute further malicious activities. The lack of proper input validation on DNS TXT records is the root weakness (CWE‑79). The vulnerability is reachable from outside the system by manipulating DNS responses that the application accepts, so any user accessing oPanel could be affected if the DNS TXT payload is delivered.

The issue affects the DNS lookup/management component of oPanel, specifically versions prior to 1.20.25. Users of any older oPanel releases should verify their installed version, as the flaw is not present in v1.20.25 or newer.

The exploitation requires controlling a DNS TXT record that is consumed by oPanel’s lookup component, which is feasible for an attacker with access to DNS zone configuration or the ability to influence DNS responses directed at the target. While the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, the ability to execute arbitrary JavaScript and hijack sessions makes the risk high for affected users. The absence of a CVSS score limits precise quantification, but the impact aligns with severe browser‑level XSS.*