Security Alert Summary
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin contains a stored cross-site scripting (XSS) vulnerability in the handling of inbound email bodies in all versions up to and including 1.17.10. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user views an injected page. The inbound email router performs only a regex match on the References header for a reply token whose hash is not cryptographically validated, so an external party that can receive or mimic a CRM outbound email may satisfy the check without a WordPress account.
CVE Details
- CVE ID: CVE-2026-96894
- Affected component: ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress
- Affected versions: All versions up to and including 1.17.10
- Published: October 30, 2026 at 6:18 PM UTC
- Last modified: October 30, 2026 at 7:20 PM UTC
- CVSS v3.1 base score: 7.2
- CVSS v3.1 severity: HIGH
- CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges / User interaction: Authentication: none (unauthenticated); Privileges required: none; User interaction: none
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Scope: CHANGED
- CWE / weakness: CWE-79 (Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue in the plugin’s inbound email processing. Inbound email bodies are not sufficiently sanitized or escaped before being stored or rendered, which allows an attacker to place arbitrary web script content into data that is later displayed in the application.
The inbound email router enforces only a regex match on the References header to detect a reply token; that token’s hash is not cryptographically validated. As described in the report, this means any external party that has received or can mimic a CRM outbound email can satisfy the router check without having a WordPress account.
Files and code locations referenced in the analysis include the plugin tag 1.17.10 sources, for example modules/crm/includes/GmailSync.php#L354, modules/crm/includes/functions-customer.php#L2698, modules/crm/includes/functions-customer.php#L2794, modules/crm/includes/functions-customer.php#L688, and the template modules/crm/views/js-templates/timeline-email.php#L19. These locations are cited in the advisory and relate to inbound email handling and timeline rendering.
Impact: when a stored XSS payload is present in the inbound email content, the payload will execute in the context of a user viewing the injected page or timeline entry. This can allow client-side attacks such as session token theft, unauthorized actions available to the viewing user, or other attacks that rely on script execution in the user’s browser. The vulnerability requires no authentication to inject content when an attacker can satisfy the router check as described.
How This Could Impact Your Website
Consider a small business using this plugin to log CRM emails. An external contractor or a third-party that received a CRM outbound message could craft or forward an email containing a script payload. When an internal staff member (for example, an HR manager or support agent) views the CRM timeline or the message entry, the script could run in their browser.
In a multi-user workflow this could lead to exposure of internal user email addresses visible in CRM entries and an increased risk of targeted phishing or social engineering against staff whose accounts are visible in the system. The impact depends on the privileges of the users who view the injected content; the vulnerability itself does not require the attacker to have a WordPress account.
If you are unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor or editor accounts that can view CRM entries.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes.
- Monitor site activity and logs for unusual behavior related to CRM entries and inbound email handling.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/erp/tags/1.17.10/modules/crm/includes/GmailSync.php#L354
- https://plugins.trac.wordpress.org/browser/erp/tags/1.17.10/modules/crm/includes/functions-customer.php#L2698
- https://plugins.trac.wordpress.org/browser/erp/tags/1.17.10/modules/crm/includes/functions-customer.php#L2794
- https://plugins.trac.wordpress.org/browser/erp/tags/1.17.10/modules/crm/includes/functions-customer.php#L688
- https://plugins.trac.wordpress.org/browser/erp/tags/1.17.10/modules/crm/views/js-templates/timeline-email.php#L19
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3769825%40erp%2Ftags%2F1.17.11&old=3728022%40erp%2Ftags%2F1.17.10
- https://www.wordfence.com/threat-intel/vulnerabilities/id/91e7dba4-e2f6-4b46-bb2b-ee8922b4f86e?source=cve
