What is the CVSS score of CVE-2026-8901?

CVE-2026-8901 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Integration for Freshsales are affected by CVE-2026-8901?

The Integration for Freshsales WordPress plugin (versions ≤1.0.15) contains a stored cross-site scripting vulnerability that enables unauthenticated attackers to inject malicious code that executes…

How to fix or mitigate CVE-2026-8901?

Within 24 hours: Audit all WordPress instances for Freshsales plugin versions ≤1.0.15; disable the plugin on affected sites. Within 7 days: Monitor vendor advisory for patch timeline; deploy WordPress security plugin with strict form-input sanitization; implement Web Application Firewall rules blocking JavaScript injection patterns in form submissions. Within 30 days: If no patch released, migrate to alternative Freshsales integration method or upgrade immediately upon vendor patch release.

Integration for Freshsales CVE-2026-8901

EUVD-2026-34941 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-06 Wordfence

GHSA-mx37-f3jf-xmhw

XSS WordPress Integration For Freshsales Contact Form 7 Wpforms Elementor Gravity Forms And More

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 02:28 vuln.today

CVE Published

Jun 06, 2026 - 01:26 nvd

HIGH 7.2

DescriptionCVE.org

The Integration for Freshsales - Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Submission Data in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes when a CRM API call fails for the submitted form and an administrator subsequently views the error log details modal in the WordPress admin panel.

AnalysisAI

Stored cross-site scripting in the Integration for Freshsales WordPress plugin (versions up to and including 1.0.15) allows unauthenticated attackers to inject arbitrary JavaScript via form submission data that executes when an administrator views the failed-CRM-call error log modal in wp-admin. The flaw, reported by Wordfence and tracked as CWE-79, carries CVSS 7.2 due to scope change (S:C) since the payload escapes from the form-submission context into the privileged admin panel, though no public exploit identified at time of analysis.

Technical ContextAI

The affected component is the Freshsales/Freshworks CRM integration plugin (cpe:2.3:a:plugcrux:integration_for_freshsales...) which bridges WordPress form builders such as Contact Form 7, WPForms, Elementor, and Gravity Forms to the Freshsales CRM. When a form submission is sent to the Freshsales API via submit-action.php and the upstream API call fails, the submitted field data is persisted to a local error log table by fw-error-log.php and later rendered in an admin-facing details modal driven by error-log.js and fw-errorlog-action.php. The referenced source lines show the submitted values are written into the DOM without adequate sanitization on input or escaping on output, the textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) pattern; because the sink is rendered in the WordPress admin context, executing script there inherits administrator privileges.

RemediationAI

Upstream fix available (changeset 3552999 on plugins.trac.wordpress.org for crm-integration-freshworks-any-form); released patched version not independently confirmed from the supplied data, so administrators should update to the latest plugin release published after changeset 3552999 via the WordPress plugin manager and verify the installed version is greater than 1.0.15. If immediate updating is not possible, compensating controls include deactivating the Integration for Freshsales plugin entirely (which disables CRM sync and breaks any forms relying on it), placing the wp-admin error-log modal endpoint behind an IP allowlist or HTTP auth at the web server, or temporarily purging and disabling the plugin error log table so the vulnerable modal renders no attacker-controlled rows (trade-off: loss of CRM failure diagnostics). Administrators should also avoid opening the error log details modal until patched and review the fw_error_log table for suspicious script content; consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c8cf71-e9b0-4241-b975-f52aeb823318 for vendor guidance.