CVE-2026-56127

pfSense Plus before 26.07 and pfSense CE before 2.9.0 are affected by a stored XSS in /firewall_rules_edit.php. An authenticated user holding the Firewall: Rules: Edit privilege can inject arbitrary JavaScript via the descr parameter. The rule description is persisted in the pfSense XML configura...