Vulnerabilidades em CRM Perks

59 resultados
Análise Vexday

Com 56 CVEs catalogadas, o ecossistema de plugins do CRM Perks apresenta 17 falhas de severidade crítica, o que representa uma concentração relevante de riscos de alta gravidade. Nenhuma CVE está atualmente sob exploração ativa confirmada pelo CISA KEV, situando o vendor abaixo da média geral do catálogo, embora esse dado não elimine o risco potencial dado que 4 vulnerabilidades já possuem Prova de Conceito pública disponível. O tipo de falha mais recorrente é CWE-502 (desserialização de dados não confiáveis), uma classe de vulnerabilidade historicamente explorada para execução remota de código e que merece atenção prioritária nos processos de hardening. A CVE mais crítica no momento, CVE-2024-30498, apresenta EPSS de 0,0227, e o surgimento de 7 novas CVEs nos últimos 90 dias indica um ritmo de descoberta ativo que justifica monitoramento contínuo.

CVE-2024-30498CRITICALWordPress CRM Perks Forms plugin <= 1.1.4 - Unauthenticated SQL Injection vulnerabilityEPSS 2.3%CVE-2022-38467MEDIUMWordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.8%CVE-2023-31212HIGHWordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to SQL InjectionEPSS 0.8%CVE-2024-30499HIGHWordPress CRM Perks Forms plugin <= 1.1.4 - SQL Injection vulnerabilityEPSS 0.6%CVE-2025-60209CRITICALWordPress Connector for Gravity Forms and Google Sheets plugin <= 1.2.6 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2025-49330CRITICALWordPress Integration for Contact Form 7 and Zoho CRM, Bigin plugin <= 1.3.0 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2023-37982MEDIUMWordPress Integration for Contact Form 7 and Salesforce Plugin <= 1.3.3 is vulnerable to Open RedirectionEPSS 0.5%CVE-2026-49105CRITICALWordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-9691CRITICALWordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-49104CRITICALWordPress Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.2.1 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-49085CRITICALWordPress WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin <= 1.1.4 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2023-38481MEDIUMWordPress Integration for WooCommerce and Zoho CRM Plugin < 1.3.7 is vulnerable to Open RedirectionEPSS 0.5%CVE-2025-58636CRITICALWordPress WP Gravity Forms Keap/Infusionsoft Plugin <= 1.2.3 - Deserialization of untrusted data VulnerabilityEPSS 0.5%CVE-2023-38478MEDIUMWordPress Integration for WooCommerce and QuickBooks Plugin <= 1.2.3 is vulnerable to Open RedirectionEPSS 0.5%CVE-2024-37463MEDIUMWordPress CRM Perks Forms plugin <= 1.1.5 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-60089CRITICALWordPress WP Gravity Forms FreshDesk plugin plugin <= 1.3.5 - Deserialization of untrusted data vulnerabilityEPSS 0.4%CVE-2025-60174CRITICALWordPress WP Gravity Forms Constant Contact plugin plugin <= 1.1.2 - Deserialization of untrusted data vulnerabilityEPSS 0.4%CVE-2025-60180CRITICALWordPress WP Gravity Forms Salesforce plugin <= 1.5.1 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2025-60091CRITICALWordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.9 - Deserialization of untrusted data vulnerabilityEPSS 0.4%CVE-2025-60090CRITICALWordPress WP Gravity Forms Insightly plugin <= 1.1.6 - Deserialization of untrusted data vulnerabilityEPSS 0.4%