Munshi by Petpooja has a stored cross‑site scripting flaw that lets an authenticated user inject malicious markup into the Purchase Inquiry thread. The bad content is assigned to innerHTML before the message is fully sanitized, so any browser that renders the thread runs the attacker’s script. This can deface pages and run arbitrary code in the victim’s browser when the thread is opened again.

Petpooja’s Munshi platform, versions released before 2026‑07‑13, is affected. The vulnerability exists in the Purchase Inquiry thread rendering code used to display messages.

The CVSS score is 5.1, indicating a moderate severity vulnerability. EPSS data is not available and the issue is not in the CISA KEV catalog, so the overall likelihood of exploitation is uncertain. Attackers need authenticated access to the platform to submit the malicious payload, but once stored the script executes in other users’ browsers, giving the attacker JavaScript execution and full-page defacement. The risk is significant for environments where users freely post purchase inquiries.