---
id: CVE-2026-109662
title: >-
  Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored
  cross-site scripting vulnerability in a public portal form that accepts
  unauthenticated submissions and stores content later rendered with
  insufficient neutralisati…
summary: >-
  Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored
  cross-site scripting vulnerability in a public portal form that accepts
  unauthenticated submissions and stores content later rendered with
  insufficient neutralisati…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T23:17:33.500'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109662'
references:
  - url: 'https://github.com/frappe/erpnext/security/advisories/GHSA-4rfh-2hfg-9m7w'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-stored-xss-via-public-portal-form
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T00:09:02.636Z'
---

## Overview

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that executes in the browser sessions of staff who review the stored record.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.