Click5 Crm Add On To Ninja Forms
Monthly
Stored cross-site scripting in the click5 CRM add-on for Ninja Forms (all versions through 1.0.1) allows an unauthenticated attacker to submit crafted content through the add-on's public form endpoint and have it persisted without sanitisation, so the payload executes in the browser of any high-privilege user - typically an administrator - who later opens the admin page that renders those submissions. Exploitation requires no credentials to plant the payload (CVSS vector PR:N), but it does require user interaction (UI:R), meaning an administrator must actually view the poisoned submission for the script to fire; publicly available exploit code exists and the bug was reported by WPScan, though there is no confirmed active exploitation (CISA KEV) at time of analysis. Scored 8.8 under the NVD/A:H/C:H/I:H vector, but our independent assessment rebases it to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (scope change, limited confidentiality and integrity, no availability impact), making this a moderate rather than top-tier priority that is bounded by whether admins routinely review unfiltered submission data.
Unauthenticated option overwrite in the click5 CRM add-on to Ninja Forms allows any remote attacker to write arbitrary WordPress blog options on sites running the add-on at version 1.0.1 or earlier, a primitive that can be chained into creating a rogue administrator account and complete site takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact (9.8), so the CVSS vector confirms no authentication and no user interaction are required against default configurations that simply have the add-on active. Publicly available exploit code exists, tracked by WPScan and mirrored in ENISA EUVD as EUVD-2026-96753, while there is no confirmed actively exploited (CISA KEV) status at time of analysis; exposure is bounded by the add-on's niche deployment rather than by any authentication or non-default configuration requirement.
Stored cross-site scripting in the click5 CRM add-on for Ninja Forms (all versions through 1.0.1) allows an unauthenticated attacker to submit crafted content through the add-on's public form endpoint and have it persisted without sanitisation, so the payload executes in the browser of any high-privilege user - typically an administrator - who later opens the admin page that renders those submissions. Exploitation requires no credentials to plant the payload (CVSS vector PR:N), but it does require user interaction (UI:R), meaning an administrator must actually view the poisoned submission for the script to fire; publicly available exploit code exists and the bug was reported by WPScan, though there is no confirmed active exploitation (CISA KEV) at time of analysis. Scored 8.8 under the NVD/A:H/C:H/I:H vector, but our independent assessment rebases it to CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (scope change, limited confidentiality and integrity, no availability impact), making this a moderate rather than top-tier priority that is bounded by whether admins routinely review unfiltered submission data.
Unauthenticated option overwrite in the click5 CRM add-on to Ninja Forms allows any remote attacker to write arbitrary WordPress blog options on sites running the add-on at version 1.0.1 or earlier, a primitive that can be chained into creating a rogue administrator account and complete site takeover. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact (9.8), so the CVSS vector confirms no authentication and no user interaction are required against default configurations that simply have the add-on active. Publicly available exploit code exists, tracked by WPScan and mirrored in ENISA EUVD as EUVD-2026-96753, while there is no confirmed actively exploited (CISA KEV) status at time of analysis; exposure is bounded by the add-on's niche deployment rather than by any authentication or non-default configuration requirement.