{"id":"CVE-2026-84259","published":"2026-10-11T07:17:25.390","lastModified":"2026-10-13T20:36:00.850","description":"The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/ab1b9586-b950-4213-891e-b973bc8f13be/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The click5 CRM add-on for WPForms WordPress plugin has a stored XSS vulnerability that allows unauthenticated attackers to inject malicious scripts into admin pages, potentially compromising administrator accounts.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and can be triggered by submitting crafted content through an exposed endpoint, with the attack vector being the admin page where the content is displayed.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary JavaScript in the context of admin sessions, potentially leading to full administrative control over the WordPress site.","remediation":"Upgrade to WPForms plugin version 1.0.4 or later, which includes the fix for the stored XSS vulnerability in the click5 CRM add-on.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","wordpress","crm","web"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:54:00.539Z"}}