CVE-2026-84261: high-severity vulnerability in click5 CRM add-on to Contact Form 7
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications
Published
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.8epss 0.3%
exploitation probability
0.3%top 79% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · click5 CRM add-on to Contact Form 7public PoCs found — 1
cve_referencewpscan.com/vulnerability/91689a2c-a282-496b-b295-435647a0bf7d/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — click5 CRM add-on to Contact Form 7
In the same product, most dangerous first.