EUVD-2026-96760
GHSA-3w72-95j2-ph87
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit payload to unauthenticated CRM endpoint
-
DeliveryStore malicious script in plugin data
-
ExploitAdmin opens submissions admin page
-
ExecutionScript executes in admin session
-
ImpactHijack admin account / create rogue admin
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the click5 CRM add-on for Contact Form 7 (version ≤1.0.4) be installed and active, and that its unauthenticated submission endpoint accept attacker-controlled content that is later rendered into an admin-facing page. Injection needs no authentication (PR:N), but the attack only succeeds when a logged-in high-privilege user (administrator) subsequently views the affected admin page containing the stored payload - this user-interaction dependency (UI:R) is the primary limiting factor and means no fully autonomous, admin-independent compromise is possible. No non-default configuration is indicated beyond having the add-on installed; the exposure is inherent to the product through 1.0.4. |
| Impact | This is a credible, actionable priority rather than a paper tiger, but the headline CVSS 8.8 overstates the direct impact. The supplied vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates confidentiality/integrity/availability all High with Scope Unchanged, which is unusually aggressive for a stored XSS - typical WPScan-class reflected/stored XSS findings carry Low impacts with a scope change (S:C), so the C:H/I:H/A:H High ratings in the input appear inflated and should be treated with caution. The genuinely dangerous signals are: injection occurs via an UNAUTHENTICATED endpoint (PR:N), the payload is stored and later rendered in an ADMIN page, and public exploit detail exists (WPScan). The mitigating signal is UI:R - exploitation only completes when a high-privilege user (admin) views the affected admin page. No EPSS score and no KEV listing were provided, so there is no evidence of active exploitation; POC availability and active exploitation are distinct and must not be conflated. Net: a realistic account-takeover vector against WordPress admins, worth prompt patching, but the CVSS impact metrics and the overall 8.8 likely overstate severity versus a standard admin-targeting stored XSS. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a crafted payload to the plugin's public submission endpoint (e.g. a CRM/contact form field), embedding malicious JavaScript that is stored without sanitization. When an administrator later opens the add-on's admin page to review submissions, the script executes in the admin's authenticated browser session, enabling session/cookie theft, CSRF-token abuse, or creation of a rogue admin account. A public exploit writeup exists via WPScan, lowering the barrier to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Stored cross-site scripting in the click5 CRM add-on for Contact Form 7 (all versions up to and including 1.0.4) lets unauthenticated attackers submit crafted content through the plugin's submission endpoint, which is stored and later rendered into an administrative page without sanitisation or escaping, so the injected script executes in the browser of a high-privilege user such as an administrator. Publicly available exploit code exists, and the add-on must be installed and active for exposure, but the attack is not autonomous: it succeeds only when a logged-in privileged user subsequently opens the poisoned admin screen. No confirmed active exploitation (CISA KEV) has been reported, and an independent reassessment rates the realistic severity considerably lower than the headline CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the required admin interaction as the primary limiting factor.
RemediationAI
No vendor-released patch was identified in the available data, so the primary action is to deactivate and, preferably, completely remove the click5 CRM add-on for Contact Form 7 (version 1.0.4 and all earlier versions) from any production WordPress site until a fixed release is confirmed; unlike many XSS mitigations, removal is reliable because the endpoint and the vulnerable admin rendering path disappear together, and the only trade-off is loss of the CRM functionality itself. If removing the add-on is not operationally possible in the short term, restrict the exposure surface: block or rate-limit the plugin's unauthenticated submission endpoint at the reverse proxy or web application firewall (trading off legitimate form submissions, which may also break the site's contact form), and enforce access controls so only known administrator IP ranges can reach the affected admin page (trading off flexible admin access). Additional compensating controls include enabling a Content Security Policy on wp-admin that disallows inline and third-party script (which can break legitimate admin UI scripts and should be rolled out in report-only mode first), keeping all administrator browsers patched, and reducing stored-XSS blast radius by enforcing short admin session lifetimes and re-authentication for privileged actions. Monitor the WPScan advisory at https://wpscan.com/vulnerability/91689a2c-a282-496b-b295-435647a0bf7d/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-84261 for a patched version; since publicly available exploit code exists, treat any logged-in administrator page view as a potential trigger and audit admin accounts and recent plugin/theme changes for signs of tampering after exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin that extends Contact Form 7 with CRM functionality; it registers an unauthenticated submission endpoint (of the kind reachable via admin-ajax.php with the wp_ajax_nopriv_ pattern or an unauthenticated REST route) that accepts and persists attacker-controlled content into CRM records. The root cause is CWE-79, improper neutralization of input during web page generation: the add-on neither sanitises input on the way in nor escapes it on the way out, so data stored in the database is echoed into an admin-facing page without esc_html(), esc_attr() or wp_kses() filtering. This yields persistent/stored XSS. Because the payload executes in the context of an authenticated administrator's browser session, the independent assessment scores S:C (scope change) while limiting C:L/I:L/A:N - direct compromise of the server and of unauthenticated users is not demonstrated, and the practical impact is session/session-token abuse, hostile script execution with admin privileges, or content injection through the admin interface. The CPE record (cpe:2.3:a:unknown:click5_crm_add-on_to_contact_form_7:*:*:*:*:*:*:*:*) lists the vendor as unknown and the version as any, reflecting incomplete mapping of the product to a maintained vendor namespace; EUVD-2026-96760 identifies the affected release line as "click5 CRM add-on to Contact Form 7 0 ≤ 1.0.4". No non-default configuration is required beyond having the add-on installed and active, so the flaw is inherent to the product through 1.0.4.
Know when Click5 Crm Add On To Contact Form 7 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated remote injection (PR:N, AV:N) but payload fires only when an admin views the page (UI:R); stored XSS crosses into the admin's browser (S:C) with limited, not total, confidentiality/integrity impact and no availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
Technical POC Analysis
CWE-79 (Improper Neutralization of Input During Web Page Generation) - Stored XSS.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Organizations using the click5 CRM add-on for Contact Form 7 (versions up to and including 1.0.4) on WordPress sites face a high-severity stored cross-site scripting risk that can run attacker-supplied script in a privileged administrator's browser. Publicly available exploit code exists, and no CISA KEV entry has been reported; exploitation requires an administrator to open a poisoned admin screen after an unauthenticated submission. Leadership should prioritize remediation because administrative compromise could lead to unauthorized site changes, data exposure, and reputational or regulatory consequences.
No vendor-released patch identified at time of analysis; interim mitigations include deactivating or removing the click5 CRM add-on for Contact Form 7 (versions up to and including 1.0.4), restricting wp-admin access to trusted IPs or VPN, deploying WAF rules to block XSS payloads, monitoring admin pages and submissions for injected content, and enforcing least privilege and session controls for administrators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB