What’s Vulnerable › Vulnerabilities

CVE-2026-39380: Open Source Point of Sale has Stored XSS in Stock Location (Configuration)

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-07 · updated 2026-07-24
• Weakness: CWE-79

Description

Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Stock Locations configuration feature. The application fails to properly sanitize user input supplied through the stock_location parameter, allowing attackers to inject malicious JavaScript code that is stored in the database and executed when rendered in the Employees interface. This vulnerability is fixed in 3.4.3.

Affected products

• opensourcepos Open Source Point of Sale: before 3.4.3 — fixed in 3.4.3

How to fix

Upgrade to a fixed version: opensourcepos Open Source Point of Sale 3.4.3. Check the vendor advisory for mitigations.

References

• https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-7hg5-68rx-xpmg
• https://github.com/opensourcepos/opensourcepos/security/advisories/GHSA-7hg5-68rx-xpmg

Get alerted when CVE-2026-39380 or the next vulnerability affects your stack