# CVE-2026-36392: FairSketch Rise CRM stored XSS in item title

Source: https://junglewise.ai/threats/cve-2026-36392-fairsketch-rise-crm-stored-xss-in-item-title  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-36392 · Severity: medium · CVSS 5.4 · Published 2026-09-10

FairSketch Rise CRM is a project management and customer relationship management (CRM) platform used by organizations to track projects and client interactions. A vulnerability in version 3.9.6 allows authenticated administrators to inject malicious JavaScript code into item titles, which is then executed in the browsers of client users viewing the store page. This can lead to session hijacking, account takeover, and phishing attacks against all client users who access affected items.

Vendors: [Fairsketch](https://junglewise.ai/threats/vendors/fairsketch).

## Quick answers

**Is CVE-2026-36392 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-36392 being exploited in the wild.

**How severe is CVE-2026-36392?** Medium severity, with a CVSS score of 5.4, published 10 September 2026.

**Which products and versions are affected?** Fairsketch Rise CRM <=3.9.6.

**Is there a fix for CVE-2026-36392?** A patch was published on 2026-07-23: Fixed in version 4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-36392 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-36392?** Check whether you run Fairsketch Rise CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the item title field of FairSketch Rise CRM versions up to 3.9.6. An authenticated administrator can inject arbitrary JavaScript payload (e.g., &lt;img src=x onerror=alert(document.cookie)&gt;) via the /index.php/items edit interface, which is persisted server-side. When any authenticated client user navigates to /index.php/store to view items, the malicious script executes in their browser context with their privileges. This allows an attacker to exfiltrate session cookies, perform unauthorized actions, or redirect users to phishing pages. The vulnerability was fixed in version 4.0 through input validation. The attack requires an authenticated admin account but affects all client users who view the store.

## Affected products

- FairSketch Rise CRM <=3.9.6

## Timeline

- 2026-02-24: disclosed: Reported to vendor via CodeCanyon support
- 2026-02-25: other: Vendor acknowledged
- 2026-05-05: other: CVE-2026-36392 assigned by MITRE
- 2026-07-23: patched: Fixed in version 4.0
- 2026-09-07: disclosed: Public disclosure

## References

- [https://github.com/moksh-nfsu/CVE-2026-36392](https://github.com/moksh-nfsu/CVE-2026-36392)