The vulnerability allows authenticated users who possess the Status: Monitoring privilege to inject arbitrary JavaScript code through several POST parameters of /status_monitoring.php. These parameters—such as graph-left, graph-right, time-period, resolution, and others—are concatenated and written directly to pfSense’s global XML configuration file without any sanitization. When the configuration is later rendered in a page, the unsanitized JavaScript string is echoed into a script context, causing the code to execute in the browser of any user who visits the Status: Monitoring page. This stores a persistent cross‑site scripting payload that can be leveraged for session hijacking, credential theft, or defacement.

Netgate’s pfSense CE versions earlier than 2.9.0 and Netgate’s pfSense Plus versions earlier than 26.07 are affected. Users running these builds may have configured graph settings in status_monitoring.php that contain unsanitized values, enabling the stored payload to be delivered to other authenticated users.

The CVSS score of 5.1 indicates a moderate severity, with no exploit probability data available from EPSS and the flaw is not listed in CISA’s KEV catalog. Exploitation requires possession of an authenticated account with the Status: Monitoring privilege; once the payload is stored, it is executed automatically in the browsers of all users who access the monitoring page. The attack vector is internal via the web application, and the risk is confined to users who can view the Status: Monitoring interface.