What is the CVSS score of EUVD-2026-43348?

EUVD-2026-43348 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of CRM Perks Forms are affected by EUVD-2026-43348?

CRM Perks Forms plugin (versions through 1.1.7) contains a reflected cross-site scripting vulnerability in form handling that allows attackers to execute malicious scripts in customer browsers when…

How to fix or mitigate EUVD-2026-43348?

Within 24 hours: disable and deactivate the CRM Perks Forms plugin on all WordPress sites, then conduct an immediate inventory of deployments running version 1.1.7 or earlier to assess exposure scope. Within 7 days: implement Web Application Firewall rules to block reflected XSS patterns in form submissions, deploy Content-Security-Policy and X-XSS-Protection headers, and activate log monitoring for exploitation attempts. Within 30 days: monitor the plugin's official repository and Patchstack for security updates; if no vendor patch is released by that date, migrate to an actively maintained CRM alternative and retire the plugin.

CRM Perks Forms EUVD-2026-43348

| CVE-2026-57421 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Crm Perks Forms Wordpress Plugin Crm Perks

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Reflected XSS is remote and unauthenticated (AV:N/PR:N) but needs the victim to click (UI:R); injected script escapes into the site origin (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:55 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms crm-perks-forms allows Reflected XSS.This issue affects CRM Perks Forms: from n/a through <= 1.1.7.

AnalysisAI

Reflected cross-site scripting in the CRM Perks Forms WordPress plugin (all versions up to and including 1.1.7) lets an unauthenticated attacker inject script that executes in a victim's browser when they open a crafted link. Patchstack catalogued the issue at CVSS 3.1 7.1, and the scope-changed vector reflects that injected script runs in the WordPress site's origin rather than a sandbox. No public exploit or active exploitation has been identified at time of analysis, so risk is driven by the low attack complexity and required user interaction rather than mass exploitation.

Technical ContextAI

CRM Perks Forms is a WordPress plugin that builds forms and pushes submissions into CRM/marketing integrations, so it processes request parameters that are echoed back into generated pages. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): user-controllable input is reflected into an HTTP response without proper output encoding or contextual escaping, allowing HTML/JavaScript to be interpreted by the browser. The affected component is identified by the CPE cpe:2.3:a:crm_perks:crm_perks_forms:*:*:*:*:*:*:*:*, placing the flaw in the plugin itself rather than WordPress core. Reflected XSS of this class typically stems from a parameter surfaced in a form-rendering, search, or preview endpoint that is written into markup verbatim.

RemediationAI

Update the CRM Perks Forms plugin to the first release above 1.1.7 published by the vendor; the provided data confirms the vulnerable range (through <= 1.1.7) but does not name an exact fixed version, so treat the fix as 'upgrade to the latest available release' and verify against the vendor changelog before deploying - released patched version not independently confirmed from the provided data. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/crm-perks-forms/vulnerability/wordpress-crm-perks-forms-plugin-1-1-7-cross-site-scripting-xss-vulnerability?_s_id=cve for the confirmed fix version. If an immediate update is not possible, place a WAF or Patchstack virtual patch in front of the plugin to filter script payloads in the reflected parameter, and deactivate the plugin on sites that do not actively use it (side effect: form functionality and CRM integrations stop working). A restrictive Content-Security-Policy blocking inline script also reduces impact but can break legitimate inline scripts elsewhere on the site.