CVE-2026-84259 in click5 CRM Plugin
Summary
by MITRE • 10/11/2026
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified within the click5 CRM add-on for WPForms WordPress plugin versions 1.0.3 and earlier represents a critical security flaw rooted in improper input validation and output encoding mechanisms. This specific issue manifests as a Stored Cross-Site Scripting (XSS) attack vector, which is particularly dangerous because it allows malicious scripts to persist on the target server rather than being executed solely within the context of a single user session or request. The core technical failure lies in the application's handling of data submitted through an unauthenticated endpoint. When users interact with this specific interface, the system accepts input without performing adequate sanitization checks to remove potentially harmful code snippets, nor does it apply proper escaping techniques before storing that data for later retrieval and display within administrative pages. This lack of defensive programming creates a direct pathway for attackers to inject executable JavaScript payloads into the database or persistent storage associated with the plugin's functionality.
From an operational perspective, this vulnerability poses a severe risk to high-privilege users, specifically administrators who have access to sensitive CRM data and WordPress configuration settings. Because the malicious content is stored server-side, it will be rendered every time an administrator accesses the affected admin page where the unsanitized input is displayed. This persistence ensures that any administrative user visiting the compromised interface will inadvertently execute the injected script within their own browser session. Consequently, attackers can leverage this execution context to perform a variety of malicious actions, including stealing session cookies and authentication tokens, hijacking active administrator sessions, performing unauthorized actions on behalf of the victim such as modifying site settings or creating new admin accounts, and exfiltrating sensitive customer data managed by the CRM add-on. The unauthenticated nature of the initial injection point means that no prior login credentials are required to exploit this flaw, significantly lowering the barrier for entry and increasing the likelihood of successful compromise against sites running vulnerable versions of the plugin.
In terms of industry standard classifications, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, because the malicious payload is stored in a database or persistent storage and later retrieved for display, it falls under the sub-category of Stored XSS (CWE-80). Furthermore, from an offensive security framework perspective, this exploit maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically JavaScript execution within a browser environment. The attack also relates to T1556, Credential Access via Browser Cookie Stealing or Session Hijacking, as the primary goal of such XSS attacks is often to capture session identifiers that grant access to privileged areas of the application. Understanding these mappings helps in categorizing the severity and selecting appropriate detection rules for intrusion prevention systems.
To mitigate this vulnerability, immediate action is required by site administrators and developers maintaining WordPress installations using WPForms with the click5 CRM add-on. The most effective remediation strategy is to upgrade the plugin to version 1.0.4 or any subsequent release where the developer has implemented proper input sanitization and output escaping functions. For environments that cannot be updated immediately due to compatibility constraints, temporary mitigations should include implementing a Web Application Firewall (WAF) rule set designed to detect and block common XSS payloads in POST requests directed at the vulnerable endpoint. Additionally, administrators can employ Content Security Policy headers to restrict script execution origins, although this is not a substitute for fixing the underlying code flaw. Regular security audits of third-party plugins are essential to ensure that input validation practices meet current industry standards and prevent similar vulnerabilities from being introduced or exploited in future updates.