The vulnerability allows an attacker to inject malicious scripts into the comment field used when creating an activity. The application does not sanitize the input before rendering it in the browser, so the script runs in any user’s session that views the activity. This reflected XSS flaw enables arbitrary client‑side code execution, which can be used to steal session cookies, hijack sessions, deface interfaces, or load additional malicious payloads.

The issue exists in Webkul Krayin CRM version 2.1.5. No other versions are listed as affected in the advisory, so only this specific release is impacted.

The CVSS score of 5.4 indicates a medium severity. With no EPSS score available and the vulnerability not listed in the CISA KEV catalog, the current likelihood of exploitation is uncertain. The flaw resides in the /admin/activities/create administrative endpoint, so an attacker would need access to that interface or be able to submit data to it. If the admin portal is exposed, privileged users are at higher risk; ordinary users might be affected only when they view the compromised activity. The overall risk depends on the organization’s exposure, but the flaw can be mitigated with an update.