Cross-site Scripting Vulnerability in CRM Perks Integration for Contact Form 7 and Constant Contact
CVE-2025-54684

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Integration For Contact Form 7 And Constant Contact
Vendor
CVE Published:
14 August 2025

What is CVE-2025-54684?

The CRM Perks Integration for Contact Form 7 and Constant Contact is susceptible to a Cross-site Scripting (XSS) vulnerability that arises from the improper neutralization of user inputs during web page generation. This vulnerability can lead to the storage of malicious scripts in the system, which may be executed in the context of another user, thereby compromising user data and site integrity. The affected versions are from the initial release through version 1.1.7.

Affected Version(s)

Integration for Contact Form 7 and Constant Contact <= 1.1.7

References

https://patchstack.com/database/wordpress/plugin/cf7-cons...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan (Patchstack Alliance)
.
CVE-2025-54684 : Cross-site Scripting Vulnerability in CRM Perks Integration for Contact Form 7 and Constant Contact