Vulnerabilities and security researches forzero-bs-crm zero-bs-crm

Feb 27, 2026

CVE, Research URL: CVE-2026-22356
Home page URL: Security reports for Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Application: Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Date: Feb 20, 2026
Research Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Automattic Jetpack CRM zero-bs-crm allows PHP Local File Inclusion.This issue affects Jetpack CRM: from n/a through <= 6.7.0.
Affected versions: max 6.7.0.
Status: vulnerable

Jun 07, 2024

CVE, Research URL: CVE-2022-3342
Home page URL: Security reports for Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Application: Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Date: Oct 20, 2023
Research Description: The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon a failed check. These steps then perform a 'file_exists' check on the value of 'zbscrmcsvimpf'. If a phar:// archive is supplied, its contents will be deserialized and an object injected in the execution stream. This allows an unauthenticated attacker to obtain object injection if they are able to upload a phar archive (for instance if the site supports image uploads) and then trick an administrator into performing an action, such as clicking a link.
Affected versions: max 5.5.1.
Status: vulnerable

CVE, Research URL: CVE-2022-3919
Home page URL: Security reports for Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Application: Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Date: Dec 12, 2022
Research Description: The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Affected versions: max 5.4.3.
Status: vulnerable

CVE, Research URL: CVE-2022-4497
Home page URL: Security reports for Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Application: Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Date: Jan 10, 2023
Research Description: The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins
Affected versions: max 5.5.
Status: vulnerable

CVE, Research URL: CVE-2023-27429
Home page URL: Security reports for Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Application: Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation
Date: Jun 21, 2023
Research Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin <= 5.4.4 versions.
Affected versions: max 5.5.0.
Status: vulnerable