CVE-2026-4165 | Worksuite HR, CRM and Project Management up to 5.5.25 /account/orders/create Client Note cross site scripting

A vulnerability was found in Worksuite HR, CRM and Project Management up to 5.5.25. It has been rated as problematic. The affected element is an unknown function of the file /account/orders/create. The manipulation of the argument Client Note leads to cross site scripting.

This vulnerability is documented as CVE-2026-4165. The attack can be initiated remotely. Additionally, an exploit exists.