CVE-2026-84261
8.8 HIGHPublished 2026-10-11 · Updated 2026-10-13
AI risk analysis
- Summary
- The click5 CRM add-on for Contact Form 7 plugin has a stored XSS vulnerability that allows unauthenticated attackers to inject malicious scripts into admin pages, potentially compromising administrator accounts. This affects versions up to 1.0.4.
- Exploitability
- Exploitation is relatively straightforward as it requires only sending crafted data to an unauthenticated endpoint, with no prerequisites for the victim user.
- Blast radius
- If exploited, this vulnerability could allow attackers to execute arbitrary code in the context of admin sessions, potentially leading to full administrative control over the WordPress site.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Contact Form 7 plugin version 1.0.5 or later to address this stored XSS vulnerability.
xsswordpresscrmweb
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-84259
- HIGHCVE-2026-84260
- HIGHCVE-2026-81739
- HIGHCVE-2026-84258
- HIGHCVE-2026-86609
- HIGHCVE-2026-87760
- HIGHCVE-2026-87762
- HIGHCVE-2026-88826
Related by shared AI tags and CWE weakness class. Browse the full archive.