CVE-2026-8901: Integration for Freshsales <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data

Synopsis

Stored cross-site scripting (XSS) in the Integration for Freshsales WordPress plugin (versions up to and including 1.0.15) allows an unauthenticated remote attacker to inject malicious JavaScript through form submission data. The payload is stored server-side and executes when a WordPress administrator opens the error log details modal in the admin panel after a failed CRM API call. Successful exploitation lets the attacker run arbitrary scripts in the administrator's browser session, enabling session hijacking, credential theft, or unauthorized admin actions. HarborGuard is tracking the advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker submits a malicious payload via a web form exposed over the network; no internal or adjacent-network position is required.

• AuthenticationNot required

  The injected payload is delivered through publicly accessible form submissions, requiring no account or login on the target site.

• Victim interactionRequired

  The payload executes only when a logged-in WordPress administrator opens the error log details modal in the admin panel, making administrator interaction a necessary condition for exploit success.

• Attack complexityDetail

  Exploitation is reliable and requires no race condition or special environmental alignment; the attacker submits a crafted form value and waits for an administrator to trigger execution.

Blast Radius

• Reads the administrator's active browser session tokens, enabling account takeover of the WordPress admin account.
• Injects additional scripts into the admin panel that can create rogue administrator accounts or exfiltrate stored credentials and API keys visible on admin pages.
• Modifies site content or plugin settings via authenticated admin actions silently performed within the hijacked browser session.