A vulnerability was discovered on WordPress plugin ZOHO CRM Lead Magnet 1.6.9.1. An input variable vulnerable to XSS are ‘Module,’ ‘EditShortcode,’ and ‘LayoutName’ in the Zoho CRM form creation page. A vulnerability allows an attacker to inject malicious code into the WordPress plugin ZOHO CRM Lead magnet by providing XSS payload as a value for vulnerable variables.
-
Products
Our ASM platform discovers, analyzes, prioritizes, & offers remediation plans for exposures in your known & unknown assets.
Our VI platform delivers threat intelligence & context on the latest cyber threats providing you with actionable insights for remediation.
-
Services
Our vulnerability management continually detects, prioritizes, & plans remediation to protect your entire IT landscape.
Our penetration testing simulates a real-world attack on your digital assets to determine the strength of your security & defenses.
-
Use Cases
-
Partners
As a partner led organization, we are committed to working with our partners to deliver world-class early warning security intelligence solutions that eliminate the adversary advantage & deliver superior security outcomes for your clients.
- Resources
-
About
.png)
Figure 01: Zoho CRM Lead Magnet..png)
Figure 02: Client key and secret id are filled in Authenticating Zoho CRM Plugin..png)
.png)
.png)
Figure 06: The JavaScript is successfully executed in the victim browser context..png)
Figure 07: The WordPress application runs on version 5.2.3..png)
Figure 08: The WordPress Zoho CRM Lead Magnet Plugin Version: 1.6.9.1..png)
Figure 09: The default cross-site scripting mitigation setting in wp.config file to prevent Cross-Site Scripting attacks.