The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin stores user‑supplied content from inbound email bodies without proper sanitization or escaping. This flaw enables an attacker to embed malicious JavaScript that is persisted in the system. When a victim loads a CRM page that outputs the stored data, the script runs in the victim’s browser, potentially allowing session hijacking, credential theft, or defacement. The weakness is a classic reflected input validation problem (CWE‑79).

WordPress sites running the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin by wedevs, version 1.17.10 or earlier are affected. The flaw exists in the inbound email router component used by the CRM module.

The CVSS score of 7.2 reflects the potential for widespread impact to confidentiality and integrity via client‑side attacks. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the vulnerability is exploitable by unauthenticated actors who can send crafted email content that passes a simple regex check. The flaw is not listed in the CISA KEV catalog, suggesting no known active exploitation, but the attack path is clear and does not require privileged access. Organizations using vulnerable plugin versions should assume the risk is significant and act accordingly.