Stored Cross-Site Scripting in CRM and Lead Management Plugin by vcita for WordPress

CVE-2025-5240

What is CVE-2025-5240?

The CRM and Lead Management by vcita plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks via the 'type' parameter. This vulnerability affects all versions up to and including 2.7.5 due to inadequate input sanitization and output escaping. Authenticated users with Contributor-level access or higher can exploit this flaw to inject arbitrary web scripts, which will execute whenever a user accesses the compromised pages, potentially leading to significant security breaches and data exposure.

References