Zoho CRM Lead Magnet <= 1.8.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Contact Form 7 Form Title
- ID
- WPSEC-2026-1445
- Plugin
- Zoho CRM Lead Magnet (zoho-crm-forms)
- Affected
- all versions before 1.8.2.5
- Remediation
- Update to 1.8.2.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Zoho CRM Lead Magnet on WPSec AttackSurface
- Fix released
- Published
Description
The Zoho CRM Lead Magnet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via mapped Contact Form 7 form titles in all versions up to, and including, 1.8.2.4 due to insufficient output escaping. The plugin's forms page placed the titles into the inline click handlers of the Edit and Delete links with JavaScript-only escaping, which does not stop a double quote from ending the string once the browser decodes the attribute, and inserted them unescaped into the HTML of the delete confirmation dialog. This makes it possible for authenticated attackers who can edit Contact Form 7 forms (Editor-level access and above by default) to inject arbitrary web scripts that execute when an administrator clicks the Edit or Delete link of the mapped form on the plugin's forms page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1445/
- https://plugins.svn.wordpress.org/zoho-crm-forms/tags/1.8.2.5/
- https://wordpress.org/plugins/zoho-crm-forms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS