{"id":"CVE-2026-84260","published":"2026-10-11T07:17:25.483","lastModified":"2026-10-13T20:36:00.850","description":"The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/ebfcc2da-5d8b-4f15-832f-02bd77844368/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The click5 CRM add-on for Gravity Forms allows stored cross-site scripting (XSS) when unauthenticated users submit content through an endpoint that doesn't sanitize input before displaying it in admin pages, potentially enabling attackers to execute malicious scripts against admin users.","exploitability":"Exploitation requires an unauthenticated user to submit malicious content via a specific endpoint, with no additional preconditions needed beyond the vulnerability being present.","blast_radius":"If exploited, the XSS could allow attackers to hijack admin sessions, steal sensitive data, or perform administrative actions on behalf of privileged users.","remediation":"Upgrade to Gravity Forms plugin version 1.0.4 or later which includes the fix for this stored XSS vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","wordpress","crm"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:54:06.231Z"}}