CVE-2026-56126: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Netgate pfSense Plus

This vulnerability involves improper neutralization of input during web page generation in pfSense Plus before version 26.07 and pfSense CE before 2.9.0. Authenticated users with the Status: Monitoring privilege can manipulate multiple POST parameters (such as graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval) which are concatenated and stored unsanitized in the global XML configuration. When the Status: Monitoring page is rendered, these unsanitized inputs are echoed into a JavaScript string context, enabling arbitrary JavaScript execution in the browsers of users who visit this page.

The vulnerability allows authenticated users with limited privileges to inject and persist malicious JavaScript code that executes in the context of other users' browsers when they access the Status: Monitoring page. This could lead to session hijacking, unauthorized actions, or other client-side attacks. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Status: Monitoring privileges to trusted users only and monitor for suspicious activity related to graph configuration parameters. Avoid visiting the Status: Monitoring page if untrusted users have such privileges.