# CVE-2026-96894: WordPress ERP plugin stored XSS in inbound email body

Source: https://junglewise.ai/threats/cve-2026-96894-the-erp-complete-hr-accounting-crm-suite-built-for-woocommerce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-96894 · Severity: high · CVSS 7.2 · Published 2026-10-30

The ERP plugin for WordPress is a comprehensive HR, accounting, and CRM system used by businesses to manage employees, finances, and customer relationships. An unauthenticated attacker can inject malicious scripts into inbound email processing that execute when users access the affected pages, potentially allowing them to steal credentials, impersonate users, or manipulate business data. The vulnerability exists because the email validation only checks for a hash token that is never cryptographically verified, meaning anyone who received a legitimate CRM email can bypass authentication.

Vendors: [weDevs](https://junglewise.ai/threats/vendors/wedevs).

## Quick answers

**Is CVE-2026-96894 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96894 being exploited in the wild.

**How severe is CVE-2026-96894?** High severity, with a CVSS score of 7.2, published 30 October 2026.

**Which products and versions are affected?** weDevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce up to and including 1.17.10.

**Is there a fix for CVE-2026-96894?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-96894 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-96894?** Check whether you run weDevs ERP: Complete HR or Accounting & CRM Suite Built for WooCommerce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the inbound email handling functionality (GmailSync) of the ERP plugin. The inbound email router validates incoming emails using only a regex match on the References header without cryptographic verification of the token hash, allowing unauthenticated attackers to inject arbitrary scripts via the email body. The injected scripts persist in the system and execute in the browser context of any user who accesses the affected pages, requiring no user interaction beyond viewing the page.

## Affected products

- WeDevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce up to and including 1.17.10

## Timeline

- 2026-10-30: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/erp/tags/1.17.10/modules/crm/includes/GmailSync.php](https://plugins.trac.wordpress.org/browser/erp/tags/1.17.10/modules/crm/includes/GmailSync.php)
- [https://plugins.trac.wordpress.org/browser/erp/tags/1.17.10/modules/crm/includes/functions-customer.php](https://plugins.trac.wordpress.org/browser/erp/tags/1.17.10/modules/crm/includes/functions-customer.php)