AlexaCRM vulnerabilities

Products

• Dynamics 365 Integration 4
• Dataverse Integration 1

Latest AlexaCRM CVEs

Newest publication first

1. CVE-2025-7695 Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route

   Published 2025-07-24

   High·CVSS 8.8 EPSS 0.69%

   The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST endpoint in versions 2.77 through 2.81. The endpoint’s handler accepts a client-supplied id, email, or login, looks up that...

2. CVE-2024-12583 Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection

   Published 2025-01-04

   Critical·CVSS 9.9 EPSS 1.4%

   The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function....

3. CVE-2023-28417 WordPress Dynamics 365 Integration plugin <= 1.3.12 - Broken Access Control vulnerability

   Published 2024-12-09

   Medium·CVSS 5.4 EPSS 0.36%

   Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.12.

4. CVE-2023-29422 WordPress Dynamics 365 Integration plugin <= 1.3.13 - Broken Access Control vulnerability

   Published 2024-12-09

   Medium·CVSS 4.3 EPSS 0.38%

   Missing Authorization vulnerability in AlexaCRM Dynamics 365 Integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamics 365 Integration: from n/a through 1.3.13.

5. CVE-2024-34550 WordPress Dynamics 365 Integration plugin <= 1.3.17 - Sensitive Data Exposure vulnerability

   Published 2024-05-09

   Medium·CVSS 5.3 EPSS 0.58%

   Insertion of Sensitive Information into Log File vulnerability in AlexaCRM Dynamics 365 Integration.This issue affects Dynamics 365 Integration: from n/a through 1.3.17.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.