Click5 Crm Add On To Wpforms
Monthly
Stored cross-site scripting (XSS) in the click5 CRM add-on to the WordPress plugin WPForms through version 1.0.3 lets an unauthenticated attacker plant a persistent script payload through the add-on's public submission endpoint; the payload is later rendered without sanitisation or escaping on an administrative page, so it executes in the browser session of a high-privilege user such as an administrator who views that page - a UI:R condition that gates actual code execution. Publicly available exploit code exists (WPScan published the vulnerability entry), but there is no confirmed active exploitation (no CISA KEV listing) and no EPSS figure was supplied; the risk is further bounded by the add-on's niche deployment and by the fact that the script runs in an admin browser rather than on the server. Our independent assessment rates this lower than the input's 8.8 (High), using a scope-changed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which keeps the exploit prerequisites - installed and active add-on, unauthenticated submission, and administrator interaction - central to any real-world prioritisation.
Unauthenticated attackers can take over any WordPress site running the click5 CRM add-on for WPForms (versions through 1.0.3) by abusing a REST endpoint that updates blog options without authorization, CSRF validation, or any check that the targeted option belongs to the add-on. Because the endpoint accepts arbitrary option names, an attacker can set registration-related options and a default administrator role to create a new admin account, or otherwise alter site configuration, leading to full site compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and exploitation requires only that this niche add-on be installed and active.
Stored cross-site scripting (XSS) in the click5 CRM add-on to the WordPress plugin WPForms through version 1.0.3 lets an unauthenticated attacker plant a persistent script payload through the add-on's public submission endpoint; the payload is later rendered without sanitisation or escaping on an administrative page, so it executes in the browser session of a high-privilege user such as an administrator who views that page - a UI:R condition that gates actual code execution. Publicly available exploit code exists (WPScan published the vulnerability entry), but there is no confirmed active exploitation (no CISA KEV listing) and no EPSS figure was supplied; the risk is further bounded by the add-on's niche deployment and by the fact that the script runs in an admin browser rather than on the server. Our independent assessment rates this lower than the input's 8.8 (High), using a scope-changed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which keeps the exploit prerequisites - installed and active add-on, unauthenticated submission, and administrator interaction - central to any real-world prioritisation.
Unauthenticated attackers can take over any WordPress site running the click5 CRM add-on for WPForms (versions through 1.0.3) by abusing a REST endpoint that updates blog options without authorization, CSRF validation, or any check that the targeted option belongs to the add-on. Because the endpoint accepts arbitrary option names, an attacker can set registration-related options and a default administrator role to create a new admin account, or otherwise alter site configuration, leading to full site compromise. The flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), publicly available exploit code exists, and exploitation requires only that this niche add-on be installed and active.