Integration for Freshsales EUVD-2026-34941

Requires the Integration for Freshsales plugin (slug crm-integration-freshworks-any-form, version ≤ 1.0.15) to be installed and active on a WordPress site with at least one public form connected to its Freshsales CRM submit action. The attacker must cause the CRM API call for their crafted submission to fail so the payload is written to the plugin's fw_error_log table, and a WordPress administrator must subsequently open the error log details modal in wp-admin for the stored script to execute - without that admin interaction, the payload remains dormant. No authentication is required to submit the payload (PR:N), but the requirements of a failed CRM call and admin review of the error log modal materially limit exploitation compared to a fully drive-by stored XSS, despite CVSS UI:N.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N reflects a network-reachable, low-complexity, unauthenticated injection with changed scope (form visitor context to admin context) and limited confidentiality/integrity impact, yielding 7.2. The UI:N rating is technically generous given the description explicitly requires an administrator to open the error log modal, so real-world triggering depends on admin behaviour and on the CRM API actually failing for the malicious submission, which constrains exploitability. No EPSS score, KEV listing, or SSVC decision data was supplied, and no public PoC is referenced; the only intelligence beyond NVD is the Wordfence Threat Intel advisory. Net risk is moderate: high impact if triggered (admin-context script execution can pivot to account takeover via nonce theft or plugin/user manipulation), but exploitation is opportunistic and gated on a failure condition plus admin review, so prioritize patching but treat it below actively exploited admin-takeover bugs.

An unauthenticated attacker submits a public WordPress form (e.g., a Contact Form 7 or WPForms form wired to the Freshsales integration) containing a JavaScript payload such as an event-handler attribute or script tag in a field like name or message, while ensuring the Freshsales CRM API call fails (for example by triggering validation errors, using malformed CRM-mapped fields, or submitting during a known Freshsales outage). The submission is written to the plugin's error log, and when a WordPress administrator later opens the error log details modal to investigate failed CRM syncs, the payload executes in their authenticated admin session and can be used to create a new administrator user, steal nonces, or install a malicious plugin. No public exploit identified at time of analysis, but the vulnerable sinks are clearly identified in the referenced trac source lines.