XSS in Creativeitem Ekushey Project Manager Crm
CVE-2026-26211
Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that page: the content attribute of the description meta element, the title element, and the text of an h4 element in the page header. The h4 occurrence is parsed as markup, so HTML placed in the system name field is rendered as markup and any event handler it carries runs. The login page is served without authentication, so the stored value executes in the browser of every visitor who loads it, including visitors who are not signed in, within the origin that serves the login form and alongside the credential fields on it. Storing the value requires an administrator session; the resulting script runs for unauthenticated visitors and persists until the setting is changed.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.004 (27.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 27.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.001
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/LindHunt/CVE-2026-26211 (technical-description, exploit)
- codecanyon.net/item/ekushey-project-manager-crm/9492104 (product)
- www.vulncheck.com/advisories/ekushey-project-manager-crm-5.0-stored-xss-via-sys… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-26211?
- CVE-2026-26211 is a medium-severity vulnerability in Creativeitem Ekushey Project Manager Crm, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2026-08-25.
- How severe is CVE-2026-26211?
- Medium severity. CVSS v3 base score is 4.8 out of 10.
- Is CVE-2026-26211 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.