This vulnerability in WP-CRM System (up to version 3.2.9) involves CWE-79: improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). An attacker with high privileges and requiring user interaction could inject malicious scripts that execute in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and scope changed.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute when viewed by other users, potentially leading to limited compromise of confidentiality, integrity, and availability of the affected system. The impact is rated medium based on the CVSS score of 5.9. There are no reports of active exploitation in the wild.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, limit high-privilege user access and exercise caution with user-generated content in the WP-CRM System. Monitor vendor channels for updates.