Cross-Site Scripting Vulnerability in Netgate pfSense Products
CVE-2026-38961

5.4MEDIUM

Key Information:

Vendor

Netgate

Status
pfSense Plus and pfSense CE
Vendor
CVE Published:
4 September 2026

What is CVE-2026-38961?

A Cross-Site Scripting vulnerability exists in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1). This flaw allows remote authenticated attackers to insert arbitrary JavaScript code through manipulated content in an RSS feed title. When an authenticated user views the dashboard, the unfiltered script executes in their browser, leading to potential data exposure or session hijacking. Proper sanitization measures are lacking in the rendering of feed title data within the widget.

References

https://github.com/pfsense/pfsense/commit/9363ac5b8651a1c...
https://docs.netgate.com/downloads/pfSense-SA-26_04.webgu...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.