CVE-2026-84261

UNKNOWN 0.0

click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.

Vendor	unknown
Product	click5 crm add-on to contact form 7
Published	Oct 11, 2026

Stay Ahead of the Next One

Get instant alerts for unknown click5 crm add-on to contact form 7

Be the first to know when new unknown vulnerabilities affecting unknown click5 crm add-on to contact form 7 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / click5 CRM add-on to Contact Form 7

0 ≤ 1.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/91689a2c-a282-496b-b295-435647a0bf7d/

Credits

Erwan LR (WPScan) WPScan