A stored XSS vulnerability exists in the Administration Settings of OPNsense prior to version 26.1.11. An attacker with the page‑system-certmanager privilege can insert arbitrary HTML or script into a certificate description field. When another privileged user opens System Settings Administration, the stored markup is rendered and the script executes in the browser context, allowing the attacker to steal session cookies, perform actions in the victim’s session, or execute other malicious code. The impact is primarily on confidentiality and integrity of the administrative interface for users with sufficient privileges.

All installations of opnsense:core running a version earlier than 26.1.11 are affected. The vulnerability has been fixed in version 26.1.11. No other products or versions are listed as impacted.

The CVSS score of 5.2 indicates moderate severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is low at present. The vulnerability is not in the CISA KEV catalog. Exploitation requires an attacker to already possess page‑system‑certmanager privileges or to compromise an account with that privilege set. The attack path is purely stored XSS within the OPNsense web interface, with no network exposure. The moderate score reflects that the vulnerability affects only privileged users and does not compromise system‑wide control directly.