{"id":"CVE-2026-125775","kind":"vulnerability","aliases":["CVE-2026-125775"],"related":[],"title":"CRM Perks Forms: reflected XSS lets attackers run scripts in visitors' browsers","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms crm-perks-forms allows Reflected XSS.This issue affects CRM Perks Forms: from n/a through 1.1.8.","summary":"CRM Perks Forms, a WordPress forms plugin, reflects user input back into pages without escaping it. An attacker can craft a link that runs script in a victim's browser, in the context of the site.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crm-perks-forms","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the `crm-perks-forms` plugin in the WordPress admin plugin list","fix":"- CRM Perks Forms: versions through `1.1.8` are affected; a fixed version is not stated in the sources","status":"open","published_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","triaged_at":"2026-11-15T14:37:30+00:00","updated_at":"2026-11-15T14:37:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T14:37:30Z","model":"claude-haiku-5-5","output":{"fix":"- CRM Perks Forms: versions through `1.1.8` are affected; a fixed version is not stated in the sources","reach":"internet","title":"CRM Perks Forms: reflected XSS lets attackers run scripts in visitors' browsers","impact":"medium","summary":"CRM Perks Forms, a WordPress forms plugin, reflects user input back into pages without escaping it. An attacker can craft a link that runs script in a victim's browser, in the context of the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","crm-perks-forms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in visitors' browsers, session tokens may be stolen","analyst_note":"Confirm the fixed version and the affected endpoint from the NVD entry or the vendor advisory.","how_to_check":"- Check the installed version of the `crm-perks-forms` plugin in the WordPress admin plugin list\n- Unknown whether the sources name a specific vulnerable endpoint","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the CRM Perks Forms plugin at version 1.1.8 or earlier are exposed to reflected script injection. Exploitation requires a victim to open a crafted link. Sites without the plugin are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4559,"output_tokens":543,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125775':15A,18A '-2026':14A,17A '1.1.8':95C 'affect':88C 'allow':84C 'attack':7A,42B 'back':35B 'browser':12A,54B 'context':57B 'craft':44B 'crm':1A,20B,25B,75C,77C,81C,89C 'crm-perks-form':19B,80C 'cross':70C 'cross-sit':69C 'cve':13A,16A 'escap':39B 'form':3A,22B,27B,30B,79C,83C,91C 'generat':68C 'improp':61C 'input':34B,64C 'issu':87C 'let':6A 'link':46B 'n/a':93C 'neutral':62C 'packag':23B 'page':37B,67C 'perk':2A,21B,26B,76C,78C,82C,90C 'plugin':31B 'reflect':4A,32B,85C 'run':8A,48B 'script':9A,49B,72C 'site':60B,71C 'user':33B 'victim':52B 'visitor':11A 'vulner':73C 'web':66C 'without':38B 'wordpress':24B,29B 'xss':5A 'xss.this':86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the CRM Perks Forms plugin at version 1.1.8 or earlier are exposed to reflected script injection. Exploitation requires a victim to open a crafted link. Sites without the plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crmperksforms","high","package","wordpress"],"campaign_type":null,"search_a":"'-125775':15A,18A '-2026':14A,17A 'attack':7A 'browser':12A 'crm':1A 'cve':13A,16A 'form':3A 'let':6A 'perk':2A 'reflect':4A 'run':8A 'script':9A 'visitor':11A 'xss':5A","search_b":"'attack':42B 'back':35B 'browser':54B 'context':57B 'craft':44B 'crm':20B,25B 'crm-perks-form':19B 'escap':39B 'form':22B,27B,30B 'input':34B 'link':46B 'packag':23B 'page':37B 'perk':21B,26B 'plugin':31B 'reflect':32B 'run':48B 'script':49B 'site':60B 'user':33B 'victim':52B 'without':38B 'wordpress':24B,29B","search_c":"'1.1.8':95C 'affect':88C 'allow':84C 'crm':75C,77C,81C,89C 'crm-perks-form':80C 'cross':70C 'cross-sit':69C 'form':79C,83C,91C 'generat':68C 'improp':61C 'input':64C 'issu':87C 'n/a':93C 'neutral':62C 'page':67C 'perk':76C,78C,82C,90C 'reflect':85C 'script':72C 'site':71C 'vulner':73C 'web':66C 'xss.this':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125775","severity":null,"published_at":"2026-11-15T14:17:24+00:00","modified_at":"2026-11-15T14:17:25+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","fetched_at":"2026-11-15T14:36:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}