The WP Dynamics CRM plugin for WordPress contains a reflected cross‑site scripting flaw that permits injection of arbitrary JavaScript into pages rendered for users. When user‑controlled data is not correctly neutralized, a crafted URL or form submission can execute code in the victim’s browser, enabling session hijacking, credential theft, or site defacement. This weakness is classified as CWE‑79.

Vulnerable versions of the CRM Perks WP Dynamics CRM plugin for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms, specifically any release through version 1.1.6, are affected.

The CVSS score of 7.1 signals a moderate‑to‑high risk, while the EPSS score of less than 1 % indicates that exploitation is currently unlikely. The plug‑in is not listed in the CISA KEV catalog, so there is no known active exploitation campaign. The likely attack vector is reflected input in the plugin’s query or form parameters, which can be triggered by a user visiting a crafted link sent by an attacker. Because the vulnerability relies on user interaction, a threat actor would need to entice a victim into clicking the malicious URL or submitting a malicious form, after which the injected script would run in the victim’s browser.