CVE-2026-0725 is a stored cross-site scripting vulnerability (CWE-79) in the Integrate Dynamics 365 CRM WordPress plugin by cyberlord92. The flaw arises from insufficient sanitization and escaping of user-supplied attributes in admin settings, enabling authenticated administrators to inject arbitrary web scripts. These scripts execute in the context of users who view the injected pages, potentially leading to information disclosure or session manipulation. The vulnerability affects all versions up to and including 1.1.1. The CVSS 3.1 base score is 4.4, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with Administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or unauthorized actions performed on behalf of users. There is no impact on availability. No known exploits in the wild have been reported.

A patch is available to remediate this vulnerability. Users of the Integrate Dynamics 365 CRM plugin should update to the latest version beyond 1.1.1 where the issue is fixed. Since this is a plugin vulnerability affecting WordPress installations, applying the official update is the recommended mitigation. No additional vendor advisory content is provided, so check the plugin source or vendor site for the official patch release and update instructions.