Cross-Site Scripting Vulnerability in WPCRM Plugin by Mojo Joomla
CVE-2025-24774

7.1HIGH

Key Information:

Vendor

WordPress
Status
WPcrm - Crm For Contact Form Cf7 & WooCommerce
Vendor
CVE Published:
27 June 2025

What is CVE-2025-24774?

The WPCRM plugin for WordPress, which facilitates integration with Contact Form 7 and WooCommerce, is susceptible to a Cross-Site Scripting (XSS) vulnerability. This issue arises from insufficient input sanitization during web page generation, allowing attackers to potentially inject malicious scripts into the web pages. If successful, this could lead to the execution of arbitrary scripts in the context of the user's session. The vulnerability impacts all versions of the plugin up to and including version 3.2.0, making it critical for users to apply updates and implement security measures.

Affected Version(s)

WPCRM - CRM for Contact form CF7 & WooCommerce <= 3.2.0

References

https://patchstack.com/database/wordpress/plugin/wpcrm/vu...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ann (Patchstack Alliance)
.
CVE-2025-24774 : Cross-Site Scripting Vulnerability in WPCRM Plugin by Mojo Joomla