CRM Perks Forms EUVD-2026-43348

Exploitation requires the target site to run CRM Perks Forms version 1.1.7 or earlier and requires user interaction: the victim must open an attacker-crafted URL containing the reflected XSS payload (CVSS UI:R). No authentication is required to craft or deliver the link (PR:N), but the injected script runs with the privileges of whoever clicks it, so impact is greatest when the victim is an authenticated administrator. Limiting factors are the mandatory click-through, the fact that reflected (non-persistent) XSS must be re-delivered to each victim, and dependence on the specific vulnerable plugin endpoint being reachable and enabled.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1 High) describes a remote, low-complexity, unauthenticated attack whose main gating factor is required user interaction (UI:R) - the victim must open a malicious link. The scope change (S:C) is characteristic of XSS because injected code executes in the trusted site origin, and the Low confidentiality/integrity/availability impacts reflect session-level theft or unwanted actions rather than full server compromise. There is no CISA KEV listing and no POC referenced in the provided data, so this is not confirmed actively exploited; EPSS and SSVC values were not supplied, which limits automatable and exploitation-probability scoring. In practice this is a real but moderate-priority issue: patch in normal cycles and prioritize higher on sites that expose privileged admin sessions, since reflected XSS landing on an authenticated administrator can escalate toward account or site takeover.

An attacker crafts a URL to a vulnerable CRM Perks Forms endpoint with a JavaScript payload in a reflected parameter and delivers it via phishing email, comment, or ad. When a logged-in administrator or visitor clicks the link, the script executes in the site's origin, letting the attacker steal session cookies, perform actions as the victim, or pivot to admin functions. Because attack complexity is low and no authentication is required to send the link, the only real barrier is convincing a target to click; no POC is referenced in the provided data.