CVE-2026-33346

HIGH

OpenEMR has stored XSS in portal_payment.php via Unescaped table_args

Title source: cna
STIX 2.1

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, a stored cross-site scripting (XSS) vulnerability in the patient portal payment flow allows a patient portal user to persist arbitrary JavaScript that executes in the browser of a staff member who reviews the payment submission. The payload is stored via `portal/lib/paylib.php` and rendered without escaping in `portal/portal_payment.php`. Version 8.0.0.2 fixes the issue.

References (2)

Core 2

Scores

CVSS v3 8.7
EPSS 0.0032
EPSS Percentile 23.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (2)
open-emr/openemr < 8.0.0.2
openemr/openemr < 8.0.0.2
Published Mar 19, 2026
Tracked Since Mar 20, 2026