CVE-2026-126462: OpenEMR before 8.5.0 Stored XSS via Eye Exam Next Visit Orders
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN[] field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user opens the Eye Exam editor to steal session identifiers or clinical data.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have permission to edit Eye Exam records. The vulnerable input is the Next Visit Orders PLAN[] field.
Who is at risk from a stored payload?
A payload executes when another user opens the Eye Exam editor containing the malicious stored value. That user’s session identifiers or accessible clinical data may be exposed to the attacker.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected. Version 8.5.0 is not identified as affected by the provided information.