CVE-2026-84259
Received Received - Intake

Stored XSS in Click5 CRM Add-on for WPForms WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-84259
EUVD
EUVD-2026-96758

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown click5 CRM add-on to WPForms 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in the click5 CRM add-on to WPForms plugin version 1.0.3 or below. It allows attackers to inject malicious scripts via the post_notifications parameter without authentication. The scripts are stored and executed when high-privilege users like administrators view an admin page.

Detection Guidance

Check if the click5 CRM add-on to WPForms plugin version 1.0.3 or below is installed. Look for suspicious input in the post_notifications parameter that may contain malicious scripts. Review admin pages for unexpected script execution or unauthorized actions.

Impact Analysis

An attacker could exploit this to perform unauthorized actions on behalf of the user, such as taking over the WordPress site, stealing sensitive data, or installing malware. Since it targets high-privilege users, the impact is severe and could lead to full site compromise.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately update the click5 CRM add-on to WPForms plugin to the latest version if available. If no update exists, consider disabling or removing the plugin until a patch is released. Monitor admin pages for unusual activity or unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84259. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart