CVE-2026-84260

Summary

The click5 CRM add-on for Gravity Forms allows stored cross-site scripting (XSS) when unauthenticated users submit content through an endpoint that doesn't sanitize input before displaying it in admin pages, potentially enabling attackers to execute malicious scripts against admin users.

Exploitability

Exploitation requires an unauthenticated user to submit malicious content via a specific endpoint, with no additional preconditions needed beyond the vulnerability being present.

Blast radius

If exploited, the XSS could allow attackers to hijack admin sessions, steal sensitive data, or perform administrative actions on behalf of privileged users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Gravity Forms plugin version 1.0.4 or later which includes the fix for this stored XSS vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.