CVE-2026-36392 describes a stored XSS vulnerability in FairSketch Rise CRM version 3.9.6. The flaw allows an authenticated administrator to inject malicious JavaScript into an item's title field. This script is stored server-side and executed in the context of any client user who views the affected store page, potentially enabling attackers to hijack sessions, take over accounts, or conduct phishing.

Successful exploitation allows an attacker with administrator access to inject malicious scripts that execute in other users' browsers. This can result in session hijacking, unauthorized account access, and phishing attacks targeting users of the CRM's store page.

No patch or official remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel and consider sanitizing or validating input fields to prevent script injection.