The Integrate Dynamics 365 CRM WordPress plugin allows an attacker who can log in with Administrator or higher privileges to inject malicious scripts by altering the field mapping configuration. The vulnerability originates from missing sanitization of user‑supplied attributes and the lack of output escaping when those attributes are rendered in pages. Injected code will execute for every user who views the affected page, potentially enabling session hijacking, defacement, credential theft, or the spread of malware.

WordPress sites that have the Integrate Dynamics 365 CRM plugin version 1.1.1 or earlier installed are affected. The plugin is identified as cyberlord92:Integrate Dynamics 365 CRM. No other versions or products are listed in the CVE data.

The vulnerability has a CVSS score of 4.4, indicating a low‑to‑moderate impact. The EPSS score of less than 1% suggests it is currently unlikely to be publicly exploited, and the issue is not present in the CISA KEV catalog. However, the attack requires authentication as an Administrator, so the risk is confined to internal users with elevated privileges. If an attacker gains such access, they can execute arbitrary JavaScript, but only on the sites where the plugin is present, and the effect is limited to the context of the infected site.