Energy CRM v2025 by Status Tracker Ltd contains a stored Cross-Site Scripting (XSS) vulnerability due to improper validation of user input in the 'JobCreatedBy' parameter via a POST request to '/crm/create_job_submit.php'. This flaw allows a remote authenticated user to inject malicious scripts that could be executed in the context of other authenticated users, potentially leading to theft of session cookies.