The X2CRM version 8.5 is vulnerable to a stored cross-site scripting (XSS) exploit. By entering a malicious XSS payload in the 'Name' field while creating a list under the 'Opportunities' section, an attacker can trigger the stored XSS payload when accessing the 'Lists' tab.