CVE-2026-84260 in Click5 Plugin
Summary
by MITRE • 10/11/2026
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified within the click5 CRM add-on for Gravity Forms WordPress plugin versions up to 1.0.3 represents a critical security flaw rooted in improper input validation and output encoding practices. This specific implementation error allows attackers to inject malicious scripts into web pages viewed by other users, specifically targeting administrative accounts with high-level privileges. The core of the issue lies in the application's failure to properly sanitize user-supplied data received through an unauthenticated endpoint before it is subsequently rendered within a protected admin interface. By neglecting these essential security controls during both the ingestion and presentation phases of data handling, the software creates a persistent vector for cross-site scripting attacks that can compromise the integrity and confidentiality of the entire WordPress environment.
From a technical perspective, this vulnerability manifests as Stored Cross-Site Scripting, also known as Persistent XSS. Unlike reflected XSS where malicious payloads are delivered via links or forms requiring immediate user interaction to execute, stored vulnerabilities persist on the target server. In this case, an attacker can submit crafted input through an endpoint that does not require authentication, bypassing initial access controls entirely. The application then stores this unsanitized content in its database without applying necessary escaping mechanisms such as HTML entity encoding or context-aware output filtering. When a high-privilege user, typically the WordPress administrator, accesses the admin page where this data is displayed, the browser interprets the stored malicious script and executes it within the security context of that privileged session. This mechanism allows the attacker to achieve code execution on behalf of the victim without any further interaction from the target user beyond simply loading the affected page.
The operational impact of this vulnerability is severe due to the privilege level of the intended victims. Since WordPress administrators possess full control over the website, including file management, plugin installation, and database access, a successful exploitation can lead to complete system compromise. An attacker leveraging this flaw could steal administrative session cookies or authentication tokens, effectively hijacking the admin account to perform actions indistinguishable from legitimate usage. Furthermore, the malicious script can be used to deface the website by altering its visual presentation, redirect users to phishing sites designed to harvest credentials, or deploy additional malware payloads such as web shells or ransomware onto the server infrastructure. The persistence of the payload means that every subsequent visit by an administrator triggers the attack, increasing the likelihood of successful exploitation and expanding the window of opportunity for malicious activities.
This vulnerability aligns with several well-defined industry standards regarding software security flaws. It is classified under CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, because the payload is stored in a database and retrieved later without proper sanitization, it falls squarely into the category of Stored XSS rather than reflected or DOM-based variants. In terms of offensive security frameworks, this attack vector corresponds to ATT&CK technique T1059, Command and Control via Web Protocols, specifically when used for initial access through browser-based execution. It also relates to T1078, Valid Accounts, as the exploitation relies on hijacking existing administrative credentials or sessions established by those accounts. Understanding these classifications helps in mapping the vulnerability to broader threat models and ensures that remediation efforts address both the immediate technical flaw and its strategic implications for organizational security posture.
Mitigation strategies must focus on implementing robust input validation and output encoding protocols immediately upon release of a patch. Developers should enforce strict allow-listing for all user inputs, ensuring that only expected data types and formats are accepted through any endpoint, regardless of authentication status. When rendering content in admin interfaces, it is imperative to apply context-sensitive escaping functions provided by the WordPress framework or equivalent secure libraries to neutralize special characters before they reach the browser. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby mitigating the impact even if a script injection occurs temporarily. For administrators using affected versions, immediate upgrading to version 1.0.4 or later is required to resolve this issue. Until patches are applied, limiting access to admin pages and monitoring for unusual activity in user-submitted content fields can help reduce exposure risk while maintaining operational continuity.