CVE-2025-39558

WordPress CRM Perks plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerability

Published Apr 17, 2025 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This issue affects CRM Perks: from n/a through <= 1.1.7.

Analysis

Technical impact

The flaw is a reflected Cross‑Site Scripting vulnerability caused by improper input sanitization in the CRM Perks support‑x module. It permits an attacker to embed malicious scripts within a crafted URL that, when accessed, will be executed by the victim’s browser during page rendering. Based on the description, it is inferred that a malicious script could be injected into the page and executed in the user’s browser.

Affected Systems

The vulnerability affects installations of the WordPress CRM Perks plugin that are version 1.1.7 or earlier. All users of the support‑x module without a newer version are impacted.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. This CVE is not listed in the CISA KEV catalog. Exploitation would likely occur via a remote attacker sending a crafted URL or form input to an unauthenticated or authenticated user. The impact is confined to the client side, allowing the execution of arbitrary JavaScript in the victim’s browser session.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

CRM Perks

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.1.7

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the CRM Perks plugin to a version released after 1.1.7 that resolves the XSS flaw, if available.
If no update is available, disable or uninstall the support‑x module to eliminate the vulnerability.
Deploy a Content Security Policy that restricts script execution to trusted domains and disallows inline scripts, which mitigates the effect of any residual XSS vectors.

Generated by OpenCVE AI on May 1, 2026 at 09:51 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-11747	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks allows Reflected XSS. This issue affects CRM Perks: from n/a through 1.1.7.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.242% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/support-x/vulnerability/wordpress-crm-perks-plugin-1-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks allows Reflected XSS. This issue affects CRM Perks: from n/a through 1.1.7.	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This issue affects CRM Perks: from n/a through <= 1.1.7.
References	https://patchstack.com/database/wordpress/plugin/support-x/vulnerability/wordpress-crm-perks-plugin-1-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/support-x/vulnerability/wordpress-crm-perks-plugin-1-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Apr 17, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 17, 2025 4:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks allows Reflected XSS. This issue affects CRM Perks: from n/a through 1.1.7.
Title		WordPress CRM Perks plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/support-x/vulnerability/wordpress-crm-perks-plugin-1-1-7-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`