A crafted HTML payload can be stored in an Email or PDF template when a user has edit permission. If the client CSP setting is disabled, the payload executes during template editing, allowing an attacker to run arbitrary code and hijack the user’s session. The weakness is a classic stored cross‑site scripting flaw (CWE‑79).

EspoCRM as sold by espocrm, for all releases prior to version 9.3.9 that contain the wysiwyg templating module and allow users to edit email or PDF templates. The vulnerability remains whenever the clientCspDisabled flag is true. Administration can affect any user with edit rights to those templates.

The CVSS score of 3.5 indicates low impact severity, and the EPSS score of less than 1% shows a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no widespread known exploitation. Exploitation requires a legitimate user with template edit permission and the client to have CSP disabled; therefore it is an authenticated, user‑interaction based attack.