click5 CRM Add-on EUVD-2026-96758

Exploitation requires the click5 CRM add-on to WPForms (version ≤1.0.3) to be installed and active, and requires an unauthenticated attacker to submit content through the add-on's public/unauthenticated submission endpoint. The stored payload only executes when a high-privilege user (an administrator) subsequently views the admin page that renders the submitted content - this administrator interaction (UI:R) is the primary limiting factor and means there is no attacker-controlled timing. No authentication is needed to plant the payload (PR:N). Risk is bounded by the add-on's niche deployment and by the fact that execution occurs in an admin browser session rather than directly on the server.

Signals are mixed and should temper the input's 8.8 (High) rating. The provided CVSS vector (AV:N/AC:L/PR:N/UI:R) describes network-reachable, low-complexity, unauthenticated injection that nonetheless requires user interaction - specifically a logged-in administrator viewing the affected admin page for the stored payload to fire. Exploitation status: publicly available exploit code exists (WPScan), but there is NO CISA KEV listing and NO EPSS score was provided, so there is no evidence of active, widespread exploitation - POC availability alone is not exploitation. The input's impact ratings C:H/I:H/A:H appear inflated for a reflected-in-admin stored XSS: canonical CWE-79 scoring is S:C/C:L/I:L/A:N, and the High impacts seem to assume full admin-account takeover as a downstream consequence rather than the direct technical impact, which inflates the 8.8 score. Realistically this is a conditional, interaction-gated issue against a niche WPForms add-on rather than a mass-exploitable priority; it warrants prompt patching on affected sites but is not a drop-everything emergency. Key gap: no EPSS and no KEV to corroborate real-world exploitation volume.

An unauthenticated attacker submits a CRM/form entry through the add-on's public endpoint, embedding a malicious JavaScript payload in a field that is later rendered in the WordPress admin dashboard without sanitization or output escaping. When an administrator opens the page displaying submissions, the stored script executes in their authenticated browser session, enabling actions such as creating a rogue admin account or installing a plugin. A public proof-of-concept is referenced by WPScan.