# CVE-2025-66921: A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows…

Source: https://junglewise.ai/threats/cve-2025-66921-a-cross-site-scripting-xss-vulnerability-in-create-update-item-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-17  
License: CC BY 4.0 with a link back

CVE-2025-66921 · Severity: high · CVSS 7.2 · Published 2025-12-17

A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter.

Technologies: [Opensourcepos Open Source Point of Sale](https://junglewise.ai/threats/technologies/open-source-point-of-sale). Vendors: [Opensourcepos](https://junglewise.ai/threats/vendors/opensourcepos).

## Quick answers

**Is CVE-2025-66921 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66921 being exploited in the wild.

**How severe is CVE-2025-66921?** High severity, with a CVSS score of 7.2, published 17 December 2025.

**Which products and versions are affected?** Opensourcepos Open Source Point of Sale. The advisory does not name versions.

**Is there a fix for CVE-2025-66921?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-66921?** Check whether you run Opensourcepos Open Source Point of Sale. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Opensourcepos Open Source Point of Sale

## Related threats

- [OpenSourcePOS missing brute-force protection on login endpoint](https://junglewise.ai/threats/cve-2026-19895-opensourcepos-missing-brute-force-protection-on-login-endpoint)
- [opensourcepos Open Source Point of Sale path traversal in getPicThumb](https://junglewise.ai/threats/cve-2026-8802-opensourcepos-open-source-point-of-sale-path-traversal-in)
- [Open Source Point of Sale Stored XSS in Daily Sales table](https://junglewise.ai/threats/cve-2026-32712-open-source-point-of-sale-stored-xss-in-daily-sales-table)
- [Open Source Point of Sale Stored XSS in Stock Locations](https://junglewise.ai/threats/cve-2026-39380-open-source-point-of-sale-stored-xss-in-stock-locations)
- [Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter…](https://junglewise.ai/threats/cve-2025-68434-open-source-point-of-sale-opensourcepos-is-a-web-based-point-of)