CVE-2026-36392

CVE-2026-36392 is a stored cross-site scripting (XSS) vulnerability in FairSketch Rise CRM version 3.9.6. An authenticated administrator injects arbitrary JavaScript into an item's title; the payload is stored server-side and executes in the browser of any client user who later visits the store page. Successful injection can lead to session hijacking, account takeover of client users, and phishing. Organizations running self-hosted Rise CRM 3.9.6 with client users browsing the store are affected. The flaw has not yet received a CVSS score and is not in CISA KEV, but one public proof-of-concept reference exists, though no confirmed in-the-wild exploitation is reported.

What to do: Upgrade Rise CRM to a release newer than 3.9.6 once the vendor publishes a fix, and check the vendor changelog for the patched version. Until patched, ensure item titles are HTML-encoded on output, restrict item-title editing to trusted administrators, and audit existing store item titles for injected scripts.