CVE-2026-8901 plugcrux CVE debrief

Who should care

Administrators and users of WordPress sites utilizing the Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin, especially those allowing form submissions.

Technical summary

The plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping. An attacker can inject web scripts that execute when a user accesses an injected page, specifically when a CRM API call fails and an administrator views the error log details modal.

Defensive priority

HIGH

Recommended defensive actions

• Update the Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More plugin to a version beyond 1.0.15.
• Implement additional security measures such as Content Security Policy (CSP) to mitigate XSS attacks.
• Regularly monitor WordPress admin panels for suspicious activities and error logs.

Evidence notes

Evidence from Wordfence indicates that the vulnerability exists in versions up to and including 1.0.15 of the plugin. Multiple source references are provided detailing the specific lines of code that contribute to the vulnerability.

Official resources