# CVE-2026-36341: Webkul Krayin CRM stored XSS in activity creation

Source: https://junglewise.ai/threats/cve-2026-36341-webkul-krayin-crm-stored-xss-in-activity-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2026-36341 · Severity: medium · CVSS 5.4 · Published 2026-05-07

Webkul Krayin CRM, a customer relationship management platform, is vulnerable to a security flaw where malicious code can be embedded in activity logs. An attacker with basic user access can create a 'Call' or 'Meeting' entry containing malicious scripts that execute when a manager or administrator views the activity. This could allow an attacker to hijack administrative sessions, steal sensitive customer data, or perform unauthorized actions on behalf of high-privileged users.

Technologies: [krayin/laravel-crm (Packagist)](https://junglewise.ai/threats/technologies/krayin-laravel-crm), [Webkul Krayin CRM](https://junglewise.ai/threats/technologies/krayin-crm). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Webkul](https://junglewise.ai/threats/vendors/webkul).

## Quick answers

**Is CVE-2026-36341 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36341 being exploited in the wild.

**How severe is CVE-2026-36341?** Medium severity, with a CVSS score of 5.4, published 7 May 2026.

**Which products and versions are affected?** krayin/laravel-crm (Packagist) = 2.1.5, ECOSYSTEM:introduced=2.1.5,fixed=2.1.6; Webkul Krayin CRM 2.1.5.

**Is there a fix for CVE-2026-36341?** Yes. krayin/laravel-crm (Packagist): upgrade to 2.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-36341 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-36341?** Check whether you run krayin/laravel-crm (Packagist) or Webkul Krayin CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- krayin/laravel-crm (Packagist): upgrade to 2.1.6 or later

  ```sh
  composer require krayin/laravel-crm:^2.1.6
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5 due to improper neutralization of user-supplied input in the 'comment' or 'description' fields during activity creation. Specifically, the '/admin/activities/create' endpoint fails to sanitize or escape HTML and JavaScript before rendering it in the administrative dashboard. An attacker with low-level privileges can inject malicious payloads into activity logs (such as 'Call' or 'Meeting' records). When a high-privileged user, such as a manager or administrator, views these activities as part of their normal workflow, the payload executes in their browser. This can lead to session hijacking via cookie theft, unauthorized data exfiltration, or account takeover. The issue is addressed in version 2.1.6 by implementing proper output encoding and input sanitization.

## Affected products

- Webkul Krayin CRM 2.1.5

## Identifiers

- CVE-2026-36341
- GHSA-j822-46r5-h4qx

## Timeline

- 2025-12-12: other: Initial fix pull request submitted
- 2025-12-29: patched: Version 2.1.6 released
- 2026-05-07: disclosed: CVE-2026-36341 published
- 2026-05-07: advisory: GitHub Advisory GHSA-j822-46r5-h4qx published

## References

- [https://github.com/krayin/laravel-crm/pull/2401](https://github.com/krayin/laravel-crm/pull/2401)
- [https://cyber.spool.co.jp/vulnerabilities/cve-2026-36341](https://cyber.spool.co.jp/vulnerabilities/cve-2026-36341)
- [https://drive.google.com/file/d/1Y_WjD4Tiq_z7zQUlddFCFMDoyyN300r9/view](https://drive.google.com/file/d/1Y_WjD4Tiq_z7zQUlddFCFMDoyyN300r9/view)
- [https://github.com/cybercrewinc/CVE-2026-36341](https://github.com/cybercrewinc/CVE-2026-36341)
- [https://github.com/krayin/laravel-crm/releases/tag/v2.1.6](https://github.com/krayin/laravel-crm/releases/tag/v2.1.6)

## Related threats

- [Krayin CRM stored template injection in web form description](https://junglewise.ai/threats/cve-2026-48543-krayin-crm-through-2-2-6-contains-a-stored-client-side-template)
- [Krayin CRM stored client-side template injection via product name](https://junglewise.ai/threats/cve-2026-48542-krayin-crm-through-2-2-6-contains-a-stored-client-side-template)
- [Krayin CRM stored template injection in person name field](https://junglewise.ai/threats/cve-2026-48541-krayin-crm-through-2-2-6-contains-a-stored-client-side-template)
- [Krayin CRM client-side template injection in lead title](https://junglewise.ai/threats/cve-2026-48540-krayin-crm-through-2-2-6-contains-a-stored-client-side-template)
- [Krayin CRM allows a remote attacker to execute arbitrary code via compose email function](https://junglewise.ai/threats/cve-2026-36340-krayin-crm-allows-a-remote-attacker-to-execute-arbitrary-code-via)