EUVD-2026-34941
GHSA-mx37-f3jf-xmhw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Integration for Freshsales - Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Submission Data in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes when a CRM API call fails for the submitted form and an administrator subsequently views the error log details modal in the WordPress admin panel.
AnalysisAI
Stored cross-site scripting in the Integration for Freshsales WordPress plugin (versions up to and including 1.0.15) allows unauthenticated attackers to inject arbitrary JavaScript via form submission data that executes when an administrator views the failed-CRM-call error log modal in wp-admin. The flaw, reported by Wordfence and tracked as CWE-79, carries CVSS 7.2 due to scope change (S:C) since the payload escapes from the form-submission context into the privileged admin panel, though no public exploit identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the Integration for Freshsales plugin (slug crm-integration-freshworks-any-form, version ≤ 1.0.15) to be installed and active on a WordPress site with at least one public form connected to its Freshsales CRM submit action. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N reflects a network-reachable, low-complexity, unauthenticated injection with changed scope (form visitor context to admin context) and limited confidentiality/integrity impact, yielding 7.2. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a public WordPress form (e.g., a Contact Form 7 or WPForms form wired to the Freshsales integration) containing a JavaScript payload such as an event-handler attribute or script tag in a field like name or message, while ensuring the Freshsales CRM API call fails (for example by triggering validation errors, using malformed CRM-mapped fields, or submitting during a known Freshsales outage). The submission is written to the plugin's error log, and when a WordPress administrator later opens the error log details modal to investigate failed CRM syncs, the payload executes in their authenticated admin session and can be used to create a new administrator user, steal nonces, or install a malicious plugin. … |
| Remediation | Upstream fix available (changeset 3552999 on plugins.trac.wordpress.org for crm-integration-freshworks-any-form); released patched version not independently confirmed from the supplied data, so administrators should update to the latest plugin release published after changeset 3552999 via the WordPress plugin manager and verify the installed version is greater than 1.0.15. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress instances for Freshsales plugin versions ≤1.0.15; disable the plugin on affected sites. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new u
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outp
The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthen
Share
External POC / Exploit Code
Leaving vuln.today