This vulnerability (CWE-79) allows an authenticated user in ERPNext 16.16.0 to persistently inject HTML or JavaScript code into specific customer fields (email_id or mobile_no). When another operator accesses the POS interface and selects the affected customer, the injected code is rendered unescaped, enabling cross-site scripting attacks. The CVSS 4.0 base score is 5.1, indicating a medium severity with network attack vector, low complexity, and limited impact on confidentiality, integrity, and availability.

An attacker with authenticated access can execute arbitrary scripts in the context of other POS operators by injecting code into customer records. This can lead to session hijacking, unauthorized actions, or information disclosure within the POS interface. However, the attack requires authentication and user interaction (selecting the customer), limiting its impact scope.

Patch status is not yet confirmed—no official fix or remediation level is provided by the vendor or advisory. Users should monitor the vendor's advisories for updates. Until a patch is available, restrict authenticated user permissions to trusted personnel only and consider additional input validation or sanitization controls on customer data fields if possible.