CVE-2026-8901 is a stored cross-site scripting vulnerability in the Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More WordPress plugin by plugcrux. Versions up to and including 1.0.15 do not properly sanitize or escape form submission data, enabling unauthenticated attackers to inject arbitrary web scripts. The injected scripts execute only when a CRM API call fails and an administrator accesses the error log details modal in the WordPress admin interface, potentially leading to information disclosure or session compromise. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity. No official patch or remediation guidance is currently documented.

An unauthenticated attacker can inject malicious scripts into form submission data that are stored and later executed in the context of an administrator viewing error logs. This can lead to partial confidentiality and integrity loss (e.g., theft of admin session tokens or manipulation of displayed data). Availability is not impacted. The attack vector is network-based with low attack complexity and no privileges or user interaction required. The scope is changed because the vulnerability affects the administrator's session context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the WordPress admin panel to trusted users only and monitor for suspicious form submissions or error log access. Avoid triggering CRM API call failures that generate error logs containing user-submitted data. Follow vendor updates closely for an official fix.