Energy CRM v2025 by Status Tracker Ltd contains a stored Cross-Site Scripting (XSS) vulnerability in the /crm/create_invoice_submit.php endpoint via the customerName_0 parameter. This flaw allows an authenticated remote attacker to inject malicious scripts that could execute in the context of other users, potentially leading to cookie session theft.