OpenEMR versions through 8.2.0 have a stored cross-site scripting (XSS) vulnerability in the patient portal template system. Authenticated administrators can inject malicious HTML and JavaScript via the template save mode, which insufficiently filters input. This vulnerability allows attackers to exfiltrate session tokens by exploiting missing output encoding and absent HttpOnly cookie attributes, leading to session hijacking of admins, clinicians, or patients who view the compromised template. The CVSS score is 4.8, indicating medium severity.