Click5 Crm Add On To Contact Form 7
Monthly
Stored cross-site scripting in the click5 CRM add-on for Contact Form 7 (all versions up to and including 1.0.4) lets unauthenticated attackers submit crafted content through the plugin's submission endpoint, which is stored and later rendered into an administrative page without sanitisation or escaping, so the injected script executes in the browser of a high-privilege user such as an administrator. Publicly available exploit code exists, and the add-on must be installed and active for exposure, but the attack is not autonomous: it succeeds only when a logged-in privileged user subsequently opens the poisoned admin screen. No confirmed active exploitation (CISA KEV) has been reported, and an independent reassessment rates the realistic severity considerably lower than the headline CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the required admin interaction as the primary limiting factor.
Unauthenticated option manipulation in the click5 CRM add-on to Contact Form 7 (versions through 1.0.4) lets remote attackers rewrite arbitrary WordPress options without authorization, a nonce, or any user interaction, which is sufficient to enable user registration and create a new administrator account for full site takeover. The flaw carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), and publicly available exploit code exists, making this a realistic and high-priority target for mass scanning against any WordPress site that has this specific add-on installed and active; Contact Form 7 alone, or WordPress without the add-on, is not affected. No CISA KEV entry was provided, so active exploitation is not independently confirmed, but the combination of unauthenticated reachability, trivial preconditions, and published exploit code warrants urgent triage and removal or blocking of the vulnerable endpoint.
Stored cross-site scripting in the click5 CRM add-on for Contact Form 7 (all versions up to and including 1.0.4) lets unauthenticated attackers submit crafted content through the plugin's submission endpoint, which is stored and later rendered into an administrative page without sanitisation or escaping, so the injected script executes in the browser of a high-privilege user such as an administrator. Publicly available exploit code exists, and the add-on must be installed and active for exposure, but the attack is not autonomous: it succeeds only when a logged-in privileged user subsequently opens the poisoned admin screen. No confirmed active exploitation (CISA KEV) has been reported, and an independent reassessment rates the realistic severity considerably lower than the headline CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the required admin interaction as the primary limiting factor.
Unauthenticated option manipulation in the click5 CRM add-on to Contact Form 7 (versions through 1.0.4) lets remote attackers rewrite arbitrary WordPress options without authorization, a nonce, or any user interaction, which is sufficient to enable user registration and create a new administrator account for full site takeover. The flaw carries a 9.8 CVSS score (AV:N/AC:L/PR:N/UI:N), and publicly available exploit code exists, making this a realistic and high-priority target for mass scanning against any WordPress site that has this specific add-on installed and active; Contact Form 7 alone, or WordPress without the add-on, is not affected. No CISA KEV entry was provided, so active exploitation is not independently confirmed, but the combination of unauthenticated reachability, trivial preconditions, and published exploit code warrants urgent triage and removal or blocking of the vulnerable endpoint.