Junglewise Threat Intelligence

CVE-2026-8901: Freshworks Integration for Freshsales Stored XSS in Form Submission Data

CVE-2026-8901 · Severity: high · CVSS 7.2 · Published 2026-06-06

Executive brief

A WordPress plugin used to connect website forms to the Freshsales CRM is vulnerable to a security flaw that allows attackers to inject malicious scripts. These scripts are stored in the website's database and trigger when an administrator views error logs related to failed form submissions. This could lead to unauthorized actions being performed in the context of an administrator's session, potentially compromising the website.

Technical details

The Integration for Freshsales plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on form submission data. An unauthenticated attacker can submit a malicious payload through any integrated form (e.g., Contact Form 7, WPForms). The payload is stored in the database and is executed in the browser of an administrative user when they open the error log details modal, specifically if the CRM API call for that submission failed. This is a blind stored XSS attack that leverages the plugin's logging mechanism to target site administrators. A patch appears to be available in versions following 1.0.15.

Affected products

  • Freshworks Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More Up to and including 1.0.15

Timeline

  • 2026-06-06: disclosed: CVE published by Wordfence/NVD

References