The vulnerability allows authenticated users with the ability to edit firewall schedules to inject arbitrary JavaScript into the schedule description field. Because the description is stored without sanitization and later inserted into an HTML attribute with only single‑quote escaping, an attacker can break out of the attribute context and execute payload code in the browsers of other users who view the rule list. This leads to unintended script execution and potential session hijacking or further compromise within the hosted environment.

Netgate provides two affected products: pfSense CE versions prior to 2.9.0 and pfSense Plus versions earlier than 26.07. Users operating these versions are susceptible to the stored XSS flaw whenever they have the Firewall: Schedules: Edit privilege and later view the related firewall rule list.

The CVSS score of 5.1 reflects a moderate severity; the EPSS score is not available and the issue is not currently listed in the CISA KEV catalog. Exploitation requires an authenticated user who has permission to edit schedules and another user with visibility of the rule list, which is a fairly common role combination in many deployments. Once the malicious description is injected, the script executes automatically in the victim’s browser, making the attack highly likely to succeed whenever the affected rule is viewed. The lack of an official workaround means vulnerability can only be mitigated by applying the vendor’s fix.