CVE-2026-36392

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, account takeover, and phishing.

• Published Sep 10, 2026
• CVSS 5.4 medium
• 0.2% chance of exploitation in the next 30 days (EPSS)

CVE-2026-36392 at the National Vulnerability Database