# Zoho CRM Lead Magnet <= 1.8.2.4 - Authenticated (Editor+) Stored Cross-Site Scripting via Contact Form 7 Form Title

- **ID:** WPSEC-2026-1445
- **Plugin:** Zoho CRM Lead Magnet (`zoho-crm-forms`), https://wordpress.org/plugins/zoho-crm-forms/
- **Affected versions:** all versions before 1.8.2.5
- **Fixed in:** 1.8.2.5 (Update to 1.8.2.5 or later.)
- **Severity:** Medium 4.0 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/zoho-crm-forms
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1445/

## Description

The Zoho CRM Lead Magnet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via mapped Contact Form 7 form titles in all versions up to, and including, 1.8.2.4 due to insufficient output escaping. The plugin's forms page placed the titles into the inline click handlers of the Edit and Delete links with JavaScript-only escaping, which does not stop a double quote from ending the string once the browser decodes the attribute, and inserted them unescaped into the HTML of the delete confirmation dialog. This makes it possible for authenticated attackers who can edit Contact Form 7 forms (Editor-level access and above by default) to inject arbitrary web scripts that execute when an administrator clicks the Edit or Delete link of the mapped form on the plugin's forms page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1445/
- https://plugins.svn.wordpress.org/zoho-crm-forms/tags/1.8.2.5/
- https://wordpress.org/plugins/zoho-crm-forms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1445/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.