The CRM and Lead Management by vcita WordPress plugin processes the 'type' parameter without proper sanitization, resulting in a stored Cross‑Site Scripting vulnerability. Authenticated users with Contributor or higher privileges can inject arbitrary JavaScript that is stored and then executed whenever any user loads the affected page. The injected scripts run in the context of the page visitor, potentially giving the attacker control over that user’s browser interaction with the site.

The vulnerable component is the WordPress plugin CRM and Lead Management by vcita developed by vcita. All released versions up to and including 2.7.5 are affected, regardless of the specific WordPress environment.

The CVSS score of 6.4 classifies this as a medium‑severity vulnerability, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild; it is not catalogued in CISA KEV. Exploitation requires that the attacker already hold authenticated Contributor or higher access. Because the vulnerability is stored XSS, it can affect every user who views the page; based on typical XSS behavior, this could enable session hijacking or altered page content for those users. The attack vector is authenticated, not remote, and the vulnerability is local to the plugin’s input handling.