Vulnerability · Published Jul 27, 2026 · Assigned by Secur0

CVE-2026-59239Stored XSS in Prospero Flow CRM email body allows administrator account takeover

High 8.6

In plain English

A high-severity cross-site scripting in Prospero Flow CRM from Roskus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.7%top 48.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload stored in an email body that is persisted without sanitization and rendered unescaped with {!! $email->body !!} when the recipient opens the message.

Affected products (as reported)

Vendor	Product	Versions
Roskus	Prospero Flow CRM	1.0.0 – before 5.4.4

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:L/SA:N

In plain English

Official description

Affected products (as reported)

References