{
 "id": "WPSEC-2026-1445",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1445/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1445/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1445/index.md",
 "title": "Zoho CRM Lead Magnet <= 1.8.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Contact Form 7 Form Title",
 "description": "The Zoho CRM Lead Magnet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via mapped Contact Form 7 form titles in all versions up to, and including, 1.8.2.4 due to insufficient output escaping. The plugin's forms page placed the titles into the inline click handlers of the Edit and Delete links with JavaScript-only escaping, which does not stop a double quote from ending the string once the browser decodes the attribute, and inserted them unescaped into the HTML of the delete confirmation dialog. This makes it possible for authenticated attackers who can edit Contact Form 7 forms (Editor-level access and above by default) to inject arbitrary web scripts that execute when an administrator clicks the Edit or Delete link of the mapped form on the plugin's forms page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
 "plugin": {
  "slug": "zoho-crm-forms",
  "name": "Zoho CRM Lead Magnet",
  "full_name": "Zoho CRM Lead Magnet",
  "wordpress_org": "https://wordpress.org/plugins/zoho-crm-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/zoho-crm-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/zoho-crm-forms"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.0,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.2.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.2.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.2.5",
 "remediation": "Update to 1.8.2.5 or later.",
 "fix_released": "2026-10-21T11:17:37+00:00",
 "published": "2026-10-22T11:46:43+00:00",
 "updated": "2026-10-21T13:26:45.756419+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1445/",
  "https://plugins.svn.wordpress.org/zoho-crm-forms/tags/1.8.2.5/",
  "https://wordpress.org/plugins/zoho-crm-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/zoho-crm-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-22"
 }
}