CVE-2026-8901

An unauthenticated attacker can submit form data containing malicious JavaScript. This script is stored in the error log when a CRM API call fails. The injected script is then executed when an administrator views the error log details modal in the WordPress admin panel. This vulnerability is triggered by insufficient input sanitization and output escaping within the form submission process [ref_id=1].

The vulnerability resides in the `add_error_log` function within the `fw-error-log.php` file. This function is responsible for inserting error details, including form data, into the `integrazo_fwcrm_form_error_log` database table. The provided code snippets from versions 1.0.14 and 1.0.15 show the relevant section where form data is processed before being inserted into the database [ref_id=1, ref_id=2].

The patch addresses the vulnerability by implementing proper input sanitization and output escaping for the form data stored in the error log. Specifically, the `add_error_log` function in `fw-error-log.php` now correctly encodes potentially harmful characters within the `$form_data` before it is stored as a JSON string. This prevents the injection of arbitrary web scripts, as the data will be treated as literal text rather than executable code when displayed to an administrator.