CVE-2026-84259 click5 CVE debrief

Who should care

Defenders responsible for WordPress plugin security, particularly those using the click5 CRM add-on to WPForms, should assess exposure and prioritize verification of the plugin version and monitoring for suspicious activity.

Why it matters

The click5 CRM add-on to WPForms WordPress plugin vulnerability requires attention from defenders responsible for WordPress plugin security, particularly those using the affected plugin, to assess exposure and prioritize verification of the plugin version and monitoring for suspicious activity.

• Potential for Stored XSS attacks against high privilege users such as admin
• Need for verification of plugin version and monitoring for suspicious activity

Technical summary

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin. The vulnerability is limited to Stored XSS attacks, and defenders should focus on verifying the plugin version and implementing additional security measures to prevent such attacks. The technical impact is limited to the admin page, and defenders should prioritize verifying the plugin version and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying the version of the click5 CRM add-on to WPForms WordPress plugin and ensuring it is up-to-date, as well as monitoring for any suspicious activity on the admin page.

Recommended defensive actions

• Verify the version of the click5 CRM add-on to WPForms WordPress plugin and ensure it is up-to-date
• Monitor for any suspicious activity on the admin page
• Implement additional security measures to prevent Stored XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being the WPScan vulnerability report. The WPScan report indicates that the click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page. However, the report's details are limited, and defenders should verify the plugin version and monitor for suspicious activity. Additional sources may provide further to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.