CVE-2026-38961

5.4 mediumEPSS 0.3%

Medium (5.4). EPSS 0.3% chance of exploitation in the next 30 days.

Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any authenticated user who views the dashboard, due to insufficient sanitization of feed title data before rendering in the widget.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-11-01)
CWE: CWE-79
Published: 2026-09-04
Modified: 2026-09-09
Record from: the NVD, synced 2026-10-19

References

https://docs.netgate.com/downloads/pfSense-SA-26_04.webgui.asc
https://github.com/pfsense/pfsense/commit/9363ac5b8651a1c7a333180425ce7719070f95f9

Check your stack JSON