CVE-2026-84261 in Click5 Plugin
Summary
by MITRE • 10/11/2026
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified within the click5 CRM add-on for the Contact Form 7 WordPress plugin represents a critical security flaw rooted in improper input validation and output encoding mechanisms. Specifically, versions of the software through 1.0.4 fail to properly sanitize or escape user-supplied data that is submitted via an unauthenticated endpoint before this data is subsequently rendered within administrative interface pages. This architectural oversight creates a direct pathway for attackers to inject malicious client-side scripts into the application's database, which are then executed in the context of privileged users when they access specific admin views. The core technical deficiency lies in the absence of rigorous input filtering and the lack of appropriate output encoding using functions such as wp_kses or htmlspecialchars before rendering data that originated from external sources within a protected administrative environment.
From an operational perspective, this flaw facilitates Stored Cross-Site Scripting attacks against high-privilege accounts, particularly administrators who possess full control over the WordPress installation. When an administrator loads the affected admin page containing the malicious payload, the browser executes the injected script with the same privileges as the logged-in user. This can lead to severe consequences including session hijacking through theft of administrative cookies or authentication tokens, credential harvesting by redirecting login forms to attacker-controlled servers, and complete compromise of the underlying web server if combined with other vulnerabilities such as arbitrary file uploads or remote code execution vectors enabled via JavaScript manipulation. The impact is particularly acute because the attack vector requires no prior authentication for initial injection, allowing any internet user to plant the payload without detection until a privileged victim interacts with it.
This vulnerability aligns closely with Common Weakness Enumeration identifiers CWE-79 Improper Neutralization of Input During Web Page Generation and CWE-83 Insufficient Output Sanitization for XSS. In terms of threat modeling and attack classification, this behavior corresponds to the MITRE ATT&CK technique T1059 Command and Scripting Interpreter via browser-based execution, specifically falling under sub-techniques related to DOM-based or stored script injection. The unauthenticated nature of the initial submission endpoint further exacerbates the risk by lowering the barrier to entry for attackers, enabling automated scanning tools to easily identify and exploit this weakness across large numbers of WordPress installations running vulnerable configurations.
Mitigation strategies must prioritize immediate patching to version 1.0.5 or later where these sanitization issues have been addressed by the developers. In environments where upgrading is not immediately feasible, administrators should implement strict web application firewall rules that detect and block common XSS payloads in POST requests targeting the specific unauthenticated endpoint associated with this add-on. Additionally, enforcing Content Security Policy headers can help mitigate the impact of successful injection attempts by restricting script execution sources. Long-term remediation involves adopting secure coding practices that mandate input validation at the point of entry and output encoding at every point of rendering, ensuring that all data flowing through application boundaries is treated as untrusted until explicitly validated against expected formats and character sets.