High severity · published Jan 27, 2025
CVE-2025-24708
WordPress WP Dynamics CRM plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerability
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-dynamics-crm allows Reflected XSS.This issue affects WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms: from n/a through <= 1.1.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WD
WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms · CRM Perks
through 1.1.6 · source: vendor
Affected product
WD
WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms
CRM Perks
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24708
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24708
patchstack.com
https://patchstack.com/database/Wordpress/Plugin/cf7-dynamics-crm/vulnerability/wordpress-wp-dynamics-crm-plugin-1-1-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve