OpenPLC Runtime CVE-2026-88020

Exploitation requires that a victim with an active/authenticated session on the OpenPLC 3 web interface be induced to click an attacker-crafted URL whose routing query-string parameter carries the script payload (UI:R). The specific prerequisite is reaching the web management interface's query-string-based program routing endpoint; no attacker authentication is needed to craft the link (PR:N), but the interface must be network-reachable to the victim and the victim must interact. Limiting factors: success depends entirely on social-engineering a legitimate operator, impact is confined to the victim's browser/session (no direct PLC-runtime compromise or availability loss), and there is no unattended/automatable path.

This is a reflected cross-site scripting flaw (CWE-79) in the OpenPLC 3 (OpenPLC Runtime) web interface, where a query-string routing parameter is reflected into the generated page without encoding. The vendor/NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 MEDIUM) is internally consistent with a classic reflected XSS: network-reachable, low complexity, no privileges, but requiring victim user interaction (UI:R) and yielding only limited confidentiality/integrity impact in the browser context (C:L/I:L), with a scope change (S:C) reflecting script execution crossing into the victim's authenticated session. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the intelligence, so exploitation status is: no public exploit identified at time of analysis. The 6.1 rating is a realistic, non-inflated MEDIUM - it is not a high-CVSS-but-low-real-risk anomaly, but neither is it a drop-everything priority: successful attack depends on luring an authenticated operator to a crafted link, and impact is confined to the browser rather than the PLC control logic itself. The main aggravating factor is context: OpenPLC drives industrial/OT processes, so session hijack of an engineering/HMI operator could be a stepping stone to control-system manipulation. No signals conflict; the primary gap is the absence of EPSS/KEV/POC data to gauge real-world exploitation likelihood.

An attacker crafts a malicious URL for an OpenPLC 3 web interface embedding a script payload in the vulnerable routing query-string parameter and delivers it to an authenticated operator via phishing or a planted link. When the operator clicks it, the unencoded parameter is reflected into the served page and the script executes in their browser, allowing session token theft or actions performed as the logged-in user. No public proof-of-concept was provided in the available intelligence.