{"id":"CVE-2026-84258","published":"2026-10-11T07:17:25.287","lastModified":"2026-10-13T20:36:00.850","description":"The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/3eae023f-a0fe-4313-9aee-18a8933eedb3/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The click5 CRM add-on for Ninja Forms WordPress plugin has a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into admin pages, potentially compromising administrator accounts. This affects versions through 1.0.1.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and only needs a user to view the affected admin page, though it may require social engineering to get an admin to visit a crafted URL or interact with the vulnerable endpoint.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript in the context of administrator sessions, potentially leading to full account compromise, data exfiltration, or further attacks within the WordPress environment.","remediation":"Upgrade to Ninja Forms plugin version 1.0.2 or later which includes the fix for the stored XSS vulnerability in the click5 CRM add-on.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","wordpress","crm","admin"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:53:54.343Z"}}