CVE-2026-38961 | CyberRota

CyberRota Analysis

AI-Generated

The RSS Widget in Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) is vulnerable to a Cross-Site Scripting (XSS) attack, allowing remote authenticated attackers to inject arbitrary JavaScript through malicious RSS feed titles. This vulnerability can lead to unauthorized script execution in the browsers of authenticated users viewing the dashboard, posing a significant risk to user data and session integrity. Organizations using these versions of pfSense should prioritize remediation to protect against potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-38961

Severity

MEDIUM

CVSS

5.4

EPSS

0.20%

Java

Original NVD Description

Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any authenticated user who views the dashboard, due to insufficient sanitization of feed title data before rendering in the widget.