CVE-2026-36392: XSS
FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, account takeover, and phishing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FairSketch Rise CRMto a version that resolves this vulnerability.Fixed in 3.9.6
Event History
Frequently Asked Questions
Who can exploit this issue, and who is affected by the injected script?
Exploitation requires an authenticated administrator who can modify an item's title. The stored script runs in the browser of any client user who visits the store page containing that item.
How can teams determine whether they may already be affected?
Review item titles for unexpected or untrusted JavaScript content, especially titles created or modified by administrator accounts. Also investigate administrator account activity and client-side reports associated with visits to the store page.
What are the likely consequences if exploitation succeeds?
The injected JavaScript can execute in affected client users' browsers, enabling session hijacking, account takeover, and phishing.