CVE-2026-84259

UNKNOWN 0.0

click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.

Vendor	unknown
Product	click5 crm add-on to wpforms
Published	Oct 11, 2026

Stay Ahead of the Next One

Get instant alerts for unknown click5 crm add-on to wpforms

Be the first to know when new unknown vulnerabilities affecting unknown click5 crm add-on to wpforms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / click5 CRM add-on to WPForms

0 ≤ 1.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/ab1b9586-b950-4213-891e-b973bc8f13be/

Credits

Erwan LR (WPScan) WPScan