This vulnerability involves stored HTML injection (CWE-79) in RISE Ultimate Project Manager & CRM. Authenticated users can inject arbitrary HTML code into invoices and messages, which are then rendered in various outputs including emails, PDFs, and chat modules. This can be exploited to conduct phishing attacks, steal credentials, and facilitate business email compromise. The presence of automated recurring invoices and messaging functionality amplifies the potential impact by spreading malicious content widely. The CVSS 3.1 base score is 8.1 (High), with network attack vector, low attack complexity, requiring privileges but no user interaction, and high confidentiality and integrity impact.

Successful exploitation allows attackers with authenticated access to inject malicious HTML content that is rendered to clients and team members via multiple channels, including emails and PDFs. This can lead to phishing attacks, credential theft, and business email compromise. The automated recurring messaging features increase the scale of potential impact by distributing malicious content repeatedly to multiple recipients.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to trusted personnel only and monitor for suspicious content in invoices and messages. Avoid enabling or limit automated recurring messaging features if possible to reduce risk exposure.