EUVD-2026-96757
GHSA-wvmg-3v75-jqv9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public form endpoint
-
DeliverySubmit entry with stored XSS payload
-
ExploitPayload persisted unsanitized in DB
-
ExecutionAdmin views entry in wp-admin
-
PersistScript executes in admin session
-
ImpactHijack admin / create rogue account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the click5 CRM add-on's unauthenticated submission endpoint be reachable (default behavior for a public form), allowing any anonymous attacker to inject a stored payload - no authentication is needed to plant it (PR:N). The decisive limiting factor is UI:R: the payload only executes when a logged-in high-privilege user (e.g. an administrator) subsequently opens the specific admin page that renders the submitted content back without sanitization or escaping. Realistic risk is therefore bounded by whether an admin actually views unfiltered submission data and by the add-on being installed alongside Ninja Forms on versions through 1.0.1. |
| Impact | Signals are mixed and point to a moderate, not top-tier, priority. The input CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R) treats this as near-critical, but that score appears inflated for a stored XSS: it claims C:H/I:H/A:H with S:U, which is inconsistent - real XSS impact is typically limited and, if anything, involves a scope change (S:C) rather than full confidentiality/integrity/availability loss on the server. The vector correctly reflects that submission is unauthenticated (PR:N) via an open endpoint, but exploitation is gated by UI:R: a high-privilege admin must actually view the affected admin page for the stored payload to fire. No EPSS score was provided and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. A public exploit reference exists (WPScan), so publicly available exploit code exists, but POC availability is distinct from in-the-wild use. Net: a credible, exploitable stored-XSS bug in a niche WordPress add-on, worth patching, but the headline 8.8 overstates true impact - the CVSS C/I/A and scope metrics should be verified against the WPScan advisory. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a CRM/form entry containing a malicious script payload through the add-on's public submission endpoint. The payload is stored without sanitization and later rendered in a WordPress admin page; when an administrator opens that page, the script executes in their authenticated session, enabling actions such as creating rogue admin accounts or stealing session context. A public proof-of-concept exists via the WPScan advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Stored cross-site scripting in the click5 CRM add-on for Ninja Forms (all versions through 1.0.1) allows an unauthenticated attacker to submit crafted content through the add-on's public form endpoint and have it persisted without sanitisation, so the payload executes in the browser of any high-privilege user - typically an administrator - who later opens the admin page that renders those submissions. Exploitation requires no credentials to plant the payload (CVSS vector PR:N), but it does require user interaction (UI:R), meaning an administrator must actually view the poisoned submission for the script to fire; publicly available exploit code exists and the bug was reported by WPScan, though there is no confirmed active exploitation (CISA KEV) at time of analysis. Scored 8.8 under the NVD/A:H/C:H/I:H vector, but our independent assessment rebases it to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (scope change, limited confidentiality and integrity, no availability impact), making this a moderate rather than top-tier priority that is bounded by whether admins routinely review unfiltered submission data.
RemediationAI
No vendor-released patch was identified at time of analysis, so the primary action is to remove or deactivate the click5 CRM add-on until an updated release appears, and to verify against the WPScan advisory at https://wpscan.com/vulnerability/3eae023f-a0fe-4313-9aee-18a8933eedb3/ and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-84258 for a fixed version. If the add-on cannot be removed, restrict the attack surface in the order of effectiveness: close or gate the unauthenticated submission endpoint (add authentication, a CAPTCHA, or a nonce requirement) via a WAF rule or a small plugin-level filter - the trade-off is that legitimate anonymous form submissions will break, which may defeat the purpose of a public CRM capture form; alternatively, block or heavily rate-limit POST traffic to the Ninja Forms submission routes from untrusted sources, accepting that determined attackers can still reach the endpoint. Second, reduce the follow-on impact by limiting who can view CRM submission data - remove the submissions capability from non-essential roles, and instruct administrators not to open unfiltered submission lists until the plugin is fixed (this is a procedural control that degrades with normal admin workflow). Third, deploy a Content-Security-Policy that disallows inline script in the wp-admin context as a defence-in-depth layer, recognising that strict CSP is difficult to operate on typical WordPress admin pages and may break legitimate dashboard functionality. Finally, monitor for the public exploit code now circulating and watch logs for anomalous submissions containing script tags or event handlers; since the payload is stored, cleaning the database (removing malicious submission records) is required even after the add-on is disabled, otherwise an already-planted payload can persist in previously rendered admin views.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-79 improper neutralisation of input during web page generation issue, manifesting in the WordPress plugin ecosystem. The click5 CRM add-on extends Ninja Forms and exposes an unauthenticated submission endpoint - normal behaviour for a public-facing contact or CRM capture form - which accepts attacker-controlled field values and stores them in the WordPress database without sanitisation or escaping. The stored data is later rendered back inside an administrative page (the CRM/submissions view) without output encoding, so any HTML/JavaScript embedded in the original submission executes in the admin's browser context with that administrator's session privileges. The core defect is a missing output-escaping stage (e.g. esc_html()/esc_attr()/wp_kses() on render) combined with the absence of input validation, rather than an access-control flaw; the submission channel is intentionally public. The CPE cpe:2.3:a:unknown:click5_crm_add-on_to_ninja_forms:*:*:*:*:*:*:*:* is recorded by NVD with an unresolved vendor field, and the EUVD entry (EUVD-2026-96757) lists affected versions as 'click5 CRM add-on to Ninja Forms 0 ≤ 1.0.1', confirming the whole release history is affected rather than a single regression. Because the flaw is a stored/second-order XSS in an admin context, it is a plausible stepping stone to session theft or administrative action in the WordPress dashboard, but the practical blast radius is limited by the UI:R precondition in our independent assessment - the payload is inert until a privileged user opens the specific vulnerable admin screen.
Know when Click5 Crm Add On To Ninja Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated remote injection (PR:N, AV:N) but execution needs an admin to view the page (UI:R); stored XSS crosses into the admin's browser context (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Technical POC Analysis
Evidence caveat up front: the WPScan record explicitly defers the proof of concept ("The PoC will be displayed on November 09, 2026") and states "No known fix." There is no runnable PoC and no patch…
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A stored cross-site scripting flaw in the click5 CRM add-on for Ninja Forms (all versions through 1.0.1) lets any anonymous visitor plant malicious content that later executes in the browser of an administrator reviewing form submissions, creating a realistic path to full WordPress site takeover. No vendor patch is available and publicly available exploit code exists, so affected sites cannot be permanently remediated at this time and remain exposed while administrators continue to use their normal workflow. Leadership should care most if these sites host customer data, support regulated or revenue-critical processes, or share credentials with broader enterprise systems, since a compromised administrator session can grant attackers control well beyond the affected website.
No vendor patch available. Interim mitigations: deactivate or remove the click5 CRM add-on for Ninja Forms (versions through 1.0.1) where it is not essential; apply WAF/virtual patching rules that strip or block script and HTML payloads on the add-on's public form endpoint; restrict access to the admin submissions page by IP allowlist or additional authentication; enforce MFA on and minimize the number of administrator accounts; force password resets and invalidate existing admin sessions; monitor stored submissions and administrator browser activity for injected content. Exploitation requires user interaction (UI:R) and can be triggered unauthenticated (PR:N); publicly available exploit code exists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB