A Cross‑Site Scripting flaw allows a remote attacker to inject arbitrary JavaScript through a crafted DNS TXT record that the DNS resolution component in oPanel processes. The injected script runs in the context of the user’s browser, enabling the attacker to hijack user sessions and potentially execute further malicious activities. The lack of proper input validation on DNS TXT records is the root weakness (CWE‑79). The vulnerability is reachable from outside the system by manipulating DNS responses that the application accepts, so any user accessing oPanel could be affected if the DNS TXT payload is delivered.

The issue affects the DNS lookup/management component of oPanel, specifically versions prior to 1.20.25. Users of any older oPanel releases should verify their installed version, as the flaw is not present in v1.20.25 or newer.

The exploitation requires controlling a DNS TXT record that is consumed by oPanel’s lookup component, which is feasible for an attacker with access to DNS zone configuration or the ability to influence DNS responses directed at the target. With an EPSS score below 1%, the likelihood of exploitation is low, but the vulnerability is not listed in CISA's KEV catalog. The ability to execute arbitrary JavaScript and hijack sessions results in a CVSS score of 6.1, indicating a medium severity browser‑level XSS that poses significant risk to affected users.