Click5 Crm Add On To Gravity Forms
Monthly
Stored cross-site scripting in the click5 CRM add-on to Gravity Forms (all versions through 1.0.3) lets an unauthenticated attacker plant script into CRM content submitted through the plugin's public, unauthenticated content-submission endpoint; the input is neither sanitised on entry nor escaped on output, so the payload executes when a high-privilege user - typically an administrator - later opens the admin page that renders the stored CRM data. Publicly available exploit code exists (WPScan published a proof-of-concept reference), but there is no CISA KEV entry or other confirmation of active exploitation. Although the bundled score of 8.8 implies severe impact, our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, because exploitation is conditional: the plugin must be installed with its submission endpoint reachable, and an administrator must subsequently review the poisoned entry before the script fires.
Unauthenticated option manipulation in the click5 CRM add-on to Gravity Forms (versions up to and including 1.0.3) lets any remote attacker rewrite arbitrary WordPress blog options and escalate to complete site takeover by enabling open registration with an administrator default role, thereby creating a new admin account. The flaw is a missing authorization/CSRF class issue exposed through a REST endpoint that neither checks the caller's capabilities nor verifies that the targeted option belongs to the add-on, so no credentials, nonce token, or user interaction are required against a default configuration. Publicly available exploit code exists, and the only real prerequisite is that the affected add-on be installed and active on a reachable WordPress site; no CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed.
Stored cross-site scripting in the click5 CRM add-on to Gravity Forms (all versions through 1.0.3) lets an unauthenticated attacker plant script into CRM content submitted through the plugin's public, unauthenticated content-submission endpoint; the input is neither sanitised on entry nor escaped on output, so the payload executes when a high-privilege user - typically an administrator - later opens the admin page that renders the stored CRM data. Publicly available exploit code exists (WPScan published a proof-of-concept reference), but there is no CISA KEV entry or other confirmation of active exploitation. Although the bundled score of 8.8 implies severe impact, our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, because exploitation is conditional: the plugin must be installed with its submission endpoint reachable, and an administrator must subsequently review the poisoned entry before the script fires.
Unauthenticated option manipulation in the click5 CRM add-on to Gravity Forms (versions up to and including 1.0.3) lets any remote attacker rewrite arbitrary WordPress blog options and escalate to complete site takeover by enabling open registration with an administrator default role, thereby creating a new admin account. The flaw is a missing authorization/CSRF class issue exposed through a REST endpoint that neither checks the caller's capabilities nor verifies that the targeted option belongs to the add-on, so no credentials, nonce token, or user interaction are required against a default configuration. Publicly available exploit code exists, and the only real prerequisite is that the affected add-on be installed and active on a reachable WordPress site; no CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed.