Stored Cross-Site Scripting Vulnerability in ERP: Complete HR, Accounting & CRM Suite by WordPress

CVE-2026-96894

What is CVE-2026-96894?

The ERP: Complete HR, Accounting & CRM Suite plugin for WordPress exposes users to a stored cross-site scripting vulnerability through the inbound email functionality. This issue is due to inadequate input sanitization and output escaping methods, allowing unauthenticated attackers to inject malicious scripts into various pages. The attack can be executed by tricking a user into accessing a page that has been manipulated to include harmful scripts, taking advantage of the plugin’s reliance on insufficiently validated references in its email processing logic.

References