CVE-2025-60169

WordPress W3SCloud Contact Form 7 to Zoho CRM plugin <= 3.2 - Cross Site Request Forgery (CSRF) vulnerability

7.1 High

Cross-Site Request Forgery (CSRF) vulnerability in W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM w3s-cf7-zoho allows Stored XSS.This issue affects W3SCloud Contact Form 7 to Zoho CRM: from n/a through <= 3.2.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.12%Up 0.1 points since Sep 26, 2025

What each source reports

CVE List Score used 7.1

WordPress W3SCloud Contact Form 7 to Zoho CRM plugin <= 3.2 - Cross Site Request Forgery (CSRF) vulnerability

Record: CVE-2025-60169
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness: CWE-352
Updated: 2026-11-02

EUVDEUVD-2025-31237 7.1

Record: EUVD-2025-31237
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-c8w6-xc3g-7r5x 7.1

Cross-Site Request Forgery (CSRF) vulnerability in W3S Cloud Technology W3SCloud Contact Form 7...

Cross-Site Request Forgery (CSRF) vulnerability in W3S Cloud Technology W3SCloud Contact Form 7 to Zoho CRM allows Stored XSS. This issue affects W3SCloud Contact Form 7 to Zoho CRM: from n/a through 3.0.

Record: GHSA-c8w6-xc3g-7r5x
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness: CWE-352
Updated: 2026-11-02

NVD 7.1

Record: CVE-2025-60169
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness: CWE-352
Updated: 2026-11-02

Affected products

w3s cloud technology w3scloud contact form 7 to zoho crm

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-60169 is a high vulnerability (CVSS 7.1) in W3s Cloud Technology W3scloud Contact Form 7 To Zoho Crm, published September 26, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. No source names a fixed version.