CVE-2026-26211: Ekushey Project Manager CRM XSS Vulnerability

CVE-2026-26211 Overview

CVE-2026-26211 is a stored Cross-Site Scripting (XSS) vulnerability in Ekushey Project Manager CRM. The application stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three locations: the content attribute of the description meta element, the <title> element, and an <h4> element in the page header. The <h4> occurrence is parsed as markup, so any HTML or event handlers placed in the system name field execute in the browser of every visitor who loads the login page. This vulnerability is tracked under CWE-79.

Critical Impact
Stored script executes for unauthenticated visitors on the login page, alongside credential fields, enabling credential theft and session hijacking against anyone who loads the page.

Affected Products

Ekushey Project Manager CRM (version 5.0 per VulnCheck Advisory)
Product distributed via CodeCanyon Product Listing
Installations exposing the login page to untrusted networks

Discovery Timeline

2026-08-25 - CVE-2026-26211 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-26211

Vulnerability Analysis

The flaw is a stored XSS in the system name configuration setting. An administrator sets the system name through the CRM's settings interface, and the application persists the value to storage. When any visitor requests the login page, the server renders that value directly into the response HTML without applying context-appropriate output encoding.

Of the three injection sinks on the login page, the <h4> header sink is the highest impact. The rendered markup is parsed by the browser as HTML, so tags and event handlers in the stored value execute as scripts. The login page requires no authentication, so the payload runs for every visitor, including users who arrive to sign in.

An attacker who compromises an administrator account, or an insider with administrator access, can plant a payload that persists until an administrator resets the setting. Because the script executes within the same origin as the credential form, it can read form input, exfiltrate submitted credentials, or redirect users to attacker-controlled pages.

Root Cause

The application concatenates untrusted stored input into an HTML template without invoking an HTML-encoding routine for the <h4> context. Templates for the meta description and <title> element also omit encoding, but their execution surface is narrower. The absence of a consistent output-encoding layer across all sinks is the underlying defect.

Attack Vector

Exploitation requires an authenticated administrator session to store the payload. Once stored, no privileges or user interaction are required to trigger execution beyond navigating to the login page. The payload lives in the settings record and runs on every subsequent load of the login form. Refer to the VulnCheck advisory and the CVE-2026-26211 GitHub repository for technical details.

Detection Methods for CVE-2026-26211

Indicators of Compromise

System name setting containing HTML tags, angle brackets, or JavaScript event handlers such as onerror, onload, or <script>.
Login page HTML source where the <h4> header, <title>, or description meta tag contains executable markup.
Outbound requests from browsers rendering the login page to unfamiliar domains, indicating credential exfiltration.
Administrator audit log entries showing modifications to the system name field from unexpected accounts or IP addresses.

Detection Strategies

Query the CRM settings table for the system name value and alert on any character outside an allow-list of alphanumerics, spaces, and basic punctuation.
Perform periodic content inspection of the unauthenticated login page and flag HTML that deviates from a known-good baseline.
Monitor web server logs for requests to the login page followed by anomalous POST or XHR traffic to third-party origins.

Monitoring Recommendations

Log every change to CRM configuration settings, including the acting administrator, source IP, and previous value.
Enable browser Content Security Policy (CSP) violation reporting to surface inline script execution attempts on the login page.
Alert on new administrator sessions from unusual geolocations before configuration changes occur.

How to Mitigate CVE-2026-26211

Immediate Actions Required

Inspect the system name setting in production and remove any HTML markup or scripting payloads.
Rotate credentials for administrator accounts that could have altered the setting and review recent authentication logs.
Restrict administrative access to the CRM to trusted networks and enforce multi-factor authentication for administrator roles.
Notify users who accessed the login page during the exposure window and require password resets where appropriate.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor the CodeCanyon product listing and the VulnCheck advisory for updated releases. Apply HTML output encoding at every sink that renders the system name, including the meta description attribute, the <title> element, and the <h4> header.

Workarounds

Set the system name to a plain text value containing only alphanumeric characters and spaces until a vendor patch is available.
Deploy a reverse proxy or Web Application Firewall (WAF) rule that strips or blocks HTML tags in responses containing the login form.
Apply a strict Content Security Policy that disallows inline scripts and unauthorized script sources on the login page.
Limit administrator role assignment to the minimum number of trusted users to reduce the risk of malicious configuration changes.

bash

# Example strict CSP header for the login page
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'