A vulnerability exists in Worksuite HR, CRM and Project Management, affecting an unknown function within the /account/orders/create file. Manipulating the argument Client Note allows the attacker to inject arbitrary JavaScript, creating a cross‑site scripting (XSS) flaw. The weakness, identified as CWE‑79, could enable a remote attacker to execute code in the context of authenticated users, potentially leading to session hijacking, data theft, or defacement. The vulnerability is specified to be exploitable from a remote location, indicating that an unauthenticated user can trigger it by sending crafted input to the affected endpoint.

Worksuite HR, CRM and Project Management products up to version 5.5.25 are vulnerable. The affected version information is explicitly stated as "up to 5.5.25"; no later versions have been reported to contain the issue.

The CVSS score of 4.8 indicates moderate severity. The EPSS score is below 1%, suggesting a low likelihood of current exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. While the attack vector is remote, the description implies that exploitation requires crafting a payload delivered via the Client Note field. No public exploit code is yet documented, but the flaw has been disclosed and may be used once patched or mitigated.