CSRF Vulnerability in W3SCloud Contact Form 7 to Zoho CRM by W3S Cloud Technology
CVE-2025-60169

7.1HIGH

Key Information:

Vendor

WordPress
Status
W3scloud Contact Form 7 To Zoho Crm
Vendor
CVE Published:
26 September 2025

What is CVE-2025-60169?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the W3SCloud Contact Form 7 to Zoho CRM plugin. This flaw allows malicious actors to execute unauthorized actions on behalf of an authenticated user, potentially leading to the injection of malicious scripts and stored XSS vulnerabilities. The affected versions range from an unspecified version up to 3.0, posing significant risks to user security and data integrity if left unmitigated.

Affected Version(s)

W3SCloud Contact Form 7 to Zoho CRM <= 3.0

References

https://patchstack.com/database/wordpress/plugin/w3s-cf7-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
JSON
.
CVE-2025-60169 : CSRF Vulnerability in W3SCloud Contact Form 7 to Zoho CRM by W3S Cloud Technology