CVE-2025-60378

High

Description

Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email compromise. Automated recurring invoices and messaging amplify the risk by distributing malicious content to multiple recipients.

SeverityHigh

CVSS8.1

Exploit probability—

ProductFairsketch Rise Ultimate Project Manager

PublishedOct 10, 2025

First seenOct 10, 2025

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

fairsketch rise_ultimate_project_manager3.9.4 or later

Vendor advisories

github.com/ajansha/CVE-2025-60378

Affected products

Product	Affected versions	Fixed in
fairsketch rise_ultimate_project_manager	v < 3.9.4	3.9.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.