What this actually is.
Technical background, root cause, and affected surface.
A vulnerability was discovered on WordPress plugin ZOHO CRM Lead Magnet 1.6.9.1. An input variable vulnerable to XSS are ‘Module,’ ‘EditShortcode,’ and ‘LayoutName’ in the Zoho CRM form creation page. A vulnerability allows an attacker to inject malicious code into the WordPress plugin ZOHO CRM Lead magnet by providing XSS payload as a value for vulnerable variables.
- Vendor
- Zoho
- Affected Product
- Lead Magnet
- CVE
- CVE-2019-19306
- Securin ID
- 2019-CSW-03-1026
- Status
- Fixed
- Date
- October 14, 2019
- Severity
- Medium
- CVSS Score
- 5.4
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
Issue 1: By exploiting Cross-site scripting vulnerability, an attacker can quickly access the user’s session by stealing cookies and exploiting the user browser.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
An attacker can inject malicious codes into a request and the server returns the script to the client in the response using a crafted URL to reflect cross-site scripting (XSS) in a lead magnet of WordPress plugin CRM lead magnet pages.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Download the latest version and apply relevant patches advised as per vendor.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered in WordPress (Zoho CRM Lead Magnet Plugin) Product.
Reported to WordPress plugin team.
WordPress plugin team acknowledged the report.
The issue acknowledged and fixed immediately.
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.