The amocrm amoCRM WebForm WordPress plugin contains a DOM-based XSS flaw that allows attackers to inject malicious scripts through unescaped user input. The flaw exists in all plugin releases up to and including version 1.1. When an attacker supplies crafted input to the form, the browser executes the payload, potentially hijacking user sessions, defacing pages, or redirecting users to malicious sites.

The vulnerability affects the amocrm amoCRM WebForm WordPress plugin provided by amocrm. All releases from the first version through version 1.1 are vulnerable. Users running the plugin on any WordPress installation should verify the version, as the issue is tied to the plugin’s form handling code.

The CVSS score of 6.5 indicates a moderate severity, while an EPSS score of less than 1% signals a very low probability of exploitation. The flaw is listed as not in the CISA KEV catalog. Exploitation requires an attacker to supply malicious data that is reflected in the browser; the typical attack vector is user interaction with a crafted form or link. While the risk is moderate, the low EPSS suggests limited current exploitation. However, due to the potential impact on user credentials and site integrity, the issue warrants timely remediation.