click5 CRM Add-on EUVD-2026-96759

Exploitation requires that the click5 CRM add-on to Gravity Forms (version ≤1.0.3) be installed and expose its public, unauthenticated content-submission endpoint - the specific feature where user-submitted CRM content is stored. No authentication is needed to plant the payload (PR:N), but execution is gated by required user interaction (UI:R): a high-privilege user, typically an administrator, must subsequently view the affected admin page where the stored, unescaped content is rendered. The payload does not fire until that admin page view occurs, which limits exploitation to environments where admins actively review submitted CRM data.

Multiple signals point to a genuine but conditional risk. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity, unauthenticated flaw requiring user interaction, and public exploit code exists (reported by WPScan), which raises the practical threat above a purely theoretical finding. However, the stated impact (C:H/I:H/A:H with Scope:Unchanged) is aggressive for a stored XSS (CWE-79): classic reflected/stored XSS typically yields S:C with C:L/I:L/A:N, so the 8.8 score likely reflects the downstream consequence of compromising an admin session rather than a direct confidentiality/integrity/availability breach of the host - verify this impact weighting with the vendor. No CISA KEV entry and no EPSS score were provided, so there is no evidence of active, widespread exploitation despite available POC code; POC availability and active exploitation are distinct signals. Net assessment: a credible, actionable priority for sites running this specific plugin because it is unauthenticated and has public exploit code, but the real-world blast radius is gated by the plugin's limited deployment footprint and the requirement that an admin view the malicious content.

An unauthenticated attacker submits a CRM entry through the plugin's public-facing endpoint, embedding a malicious JavaScript payload in a field that is stored without sanitization or output escaping. When a site administrator later opens the relevant admin page to review submissions, the payload executes in their authenticated browser session (UI:R), enabling session/cookie theft, creation of rogue admin accounts, or injection of further site changes. Public exploit code for this flaw is available via WPScan, lowering the barrier to reliable exploitation.