The plugin fails to sanitize and escape form submission data that is stored in an error log. When a CRM API call fails and an administrator opens the error‑log modal, the injected script is executed in the administrator’s browser. This allows an unauthenticated attacker to run arbitrary JavaScript in the context of an authenticated administrator, which can be used to steal session data, deface the site, or perform privileged actions without further authentication.

WordPress installations that use the "Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More" plugin, versions up to and including 1.0.15. Any site consuming forms from this plugin and displaying error‑log modals is vulnerable.

The CVSS score of 7.2 indicates a moderate to high risk. No EPSS score is published, so the current exploitation probability is uncertain. The vulnerability is not listed in the CISA KEV catalog, but the lack of authentication on the attack vector and the high impact of exploiting an administrator’s session suggest a notable risk. An attacker can trigger the vulnerability simply by submitting a crafted form; the no‑auth prerequisite and reliance on a subsequent administrator action make the exploit straightforward for a determined attacker.