CVE-2025-5240: vcita CRM WordPress Plugin XSS Vulnerability

CVE-2025-5240 Overview

CVE-2025-5240 is a Stored Cross-Site Scripting (XSS) vulnerability in the CRM and Lead Management by vcita plugin for WordPress. The flaw affects all versions up to and including 2.7.5. The vulnerability originates in the type parameter, which lacks proper input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected script executes in the browser of any user who visits an affected page. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated Contributor-level users can persist arbitrary JavaScript in WordPress pages, enabling session theft, account takeover, and drive-by administrative actions when higher-privileged users view the affected content.

Affected Products

CRM and Lead Management by vcita plugin for WordPress — all versions up to and including 2.7.5
WordPress sites using the vulnerable vcita-widgets-functions.php shortcode handler
Any WordPress instance permitting Contributor-level (or higher) account registration with the plugin active

Discovery Timeline

2025-07-22 - CVE-2025-5240 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5240

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the vcita CRM plugin's widget shortcode processing logic. The type parameter is accepted from user-controlled input and rendered back into page output without adequate sanitization or escaping. Because the payload is persisted in the database and rendered whenever the page is viewed, every visitor executes the attacker's script in their browser session.

Stored XSS in an administrator-viewable context is particularly impactful. When an administrator opens a page containing the injected payload, the attacker's script runs with the administrator's browser privileges. This can be used to create new administrative accounts, install malicious plugins, or exfiltrate authentication cookies. The exploit requires a Contributor account, which is a low barrier on sites permitting open registration or content contribution workflows.

Root Cause

The root cause is missing input sanitization and missing output escaping on the type shortcode attribute inside vcita-widgets-functions.php. The plugin echoes the attribute value directly into rendered HTML, allowing HTML and JavaScript tokens to be interpreted by the browser. Fix details can be reviewed in the WordPress plugin changeset and the surrounding code in vcita-widgets-functions.php.

Attack Vector

An authenticated attacker with at least Contributor privileges submits a post or page containing the vcita widget shortcode with a crafted type attribute containing HTML or JavaScript. The malicious value is stored in the WordPress database. When the page is rendered, the payload executes in the context of the site origin for every viewer, including administrators. Full technical write-up is available in the Wordfence Vulnerability Report.

No public proof-of-concept exploit code is currently listed for this issue.

Detection Methods for CVE-2025-5240

Indicators of Compromise

Unexpected <script>, onerror=, onload=, or javascript: strings inside wp_posts.post_content where vcita shortcodes are used.
New Administrator or Editor accounts created shortly after a Contributor user published or edited a page.
Outbound browser requests from admin sessions to unfamiliar third-party domains following visits to pages containing vcita widgets.
Unexplained modifications to plugins, themes, or wp_options following administrative page previews.

Detection Strategies

Audit stored posts, pages, and custom post types for vcita shortcodes containing type= attributes with HTML-encoded or script-like values.
Deploy a web application firewall (WAF) rule to inspect POST requests to post.php and admin-ajax.php for suspicious type parameter content targeting vcita shortcodes.
Correlate Contributor-role content submissions with subsequent administrator page views and privilege changes.

Monitoring Recommendations

Enable WordPress audit logging for user role changes, plugin installations, and post revisions authored by Contributor-level accounts.
Monitor Content Security Policy (CSP) violation reports for inline script execution originating from CMS-rendered pages.
Alert on any newly created administrator accounts and on modifications to wp-config.php or the mu-plugins directory.

How to Mitigate CVE-2025-5240

Immediate Actions Required

Update the CRM and Lead Management by vcita plugin to a version newer than 2.7.5 that includes the fix from changeset 3256449.
Review all pages and posts created or modified by Contributor-level accounts and remove any suspicious shortcode content.
Rotate WordPress administrator passwords and invalidate active sessions if injected content is discovered.
Audit the user roster and remove or downgrade Contributor accounts that are not required.

Patch Information

The vendor addressed the missing sanitization in the plugin trunk via changeset 3256449. Site owners should apply the latest release available through the WordPress plugin repository. WordPress auto-updates for the plugin should be enabled where operationally acceptable.

Workarounds

Deactivate the CRM and Lead Management by vcita plugin until the patched version can be deployed.
Restrict Contributor-level account creation and require administrator approval for content publication workflows.
Deploy a WAF rule blocking shortcode payloads that contain <script, javascript:, or common event-handler attributes in the type parameter.
Enforce a strict Content Security Policy that disallows inline script execution on the public site.

bash

# Example: force plugin update via WP-CLI
wp plugin update crm-customer-relationship-management-by-vcita

# Verify installed version is greater than 2.7.5
wp plugin get crm-customer-relationship-management-by-vcita --field=version

# Temporary mitigation: deactivate the plugin
wp plugin deactivate crm-customer-relationship-management-by-vcita