CVE-2025-5240

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5240

The CVE-2025-5240 entry applies to the WordPress plugin CRM and Lead Management by vcita, affected up to version 2.7.5. It describes a Stored Cross-Site Scripting (XSS) vulnerability via the type parameter that authenticated attackers with Contributor-level access and above can exploit to inject ...

CVE-2025-5240 CRM and Lead Management by vcita <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-5240 CRM and Lead Management by vcita <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress CRM and Lead Management by vcita plugin <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via type Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin CRM and Lead Management by vcita versions = 2.7.5...