CRMZT Connector for Zoho by TechArk

Easily connect your Gravity Forms to your Zoho CRM account. Automatically send form submissions to Zoho as Leads, Contacts, or entries in custom modules. Eliminate manual data entry and keep your CRM up to date in real-time.

Key Features:
– Map Gravity Forms fields to Zoho CRM fields
– Supports Zoho Leads, Contacts, and custom modules
– Send data instantly upon form submission
– Easy setup with Zoho OAuth authentication
– Logs and debug tools for integration monitoring
– Improve data accuracy and reduce manual entry

Whether you’re collecting leads, managing inquiries, or capturing customer data, this plugin ensures your Zoho CRM remains synced and organized with data from your WordPress site.

Resources

This plugin uses SweetAlert for alerts:
– Source: https://github.com/t4t5/sweetalert

All minified files in the plugin are compiled using [Webpack/NPM/etc]. Original source files are included in the /src/ directory.

External Services

This plugin connects to external services to enable CRM integration and geolocation features. Below are the details of the services used:

Zoho CRM API

This plugin integrates with Zoho CRM to synchronize lead data, fetch user details, and manage form submissions.

• What is sent: OAuth access tokens, lead form data (e.g. name, email, phone, and other lead-related fields), and site information.
• Why: To authenticate requests, push lead data to Zoho CRM, and fetch layout or user settings from Zoho.
• When: On plugin setup (OAuth token generation), lead form submission, and when settings are configured.
• Endpoints used:
  • https://accounts.zoho.com/oauth/v2/token
  • https://www.zohoapis.com/crm/v2/ (various endpoints for Leads, Users, Layouts, etc.)
• Service Provider: Zoho Corporation Pvt. Ltd.
• Terms of Service: https://www.zoho.com/terms.html
• Privacy Policy: https://www.zoho.com/privacy.html

MaxMind GeoIP Service

This plugin optionally uses MaxMind’s GeoIP service to determine the approximate location of users based on their IP address.

• What is sent: User IP address.
• Why: To detect the user’s location and pre-fill location-related form fields or analytics.
• When: When a user accesses a form or page that uses location detection.
• Endpoint used: https://geoip.maxmind.com/geoip/v2.1/city/
• Service Provider: MaxMind, Inc.
• Terms of Service: https://www.maxmind.com/en/geoip2-services-agreement
• Privacy Policy: https://www.maxmind.com/en/privacy-policy

Reviewer Notes

This plugin makes use of Google Ads URL parameters such as ref, gclid, and GCLID which are appended by Google automatically for ad tracking purposes.

These parameters are not generated or controlled by the plugin or the user and as such, cannot include WordPress nonces.

To maintain security:
– All such input values are sanitized using sanitize_text_field() and wp_unslash() as soon as they are accessed.
– These values are only used in temporary storage (such as cookies or sessions) and are never used for authentication, privilege escalation, or sensitive logic.
– All outputs are escaped using appropriate esc_* functions (esc_html(), esc_attr()).
– Inline code comments are provided in refcookie.php for context.

Nonce validation is not feasible in this context as these URLs are generated externally. However, the plugin fully complies with WordPress security practices for sanitization, validation, and escaping.