CVE-2026-84260 click5 CVE debrief

Who should care

Defenders responsible for WordPress installations that use the click5 CRM add-on to Gravity Forms plugin should assess exposure and prioritize verification and potential remediation.

Why it matters

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of admin pages to potential XSS attacks, as Stored XSS could be used against high privilege users such as admin.

• Potential for Stored XSS attacks against high privilege users such as admin.
• Exposure of admin pages to potential XSS attacks.
• Need for verification of vulnerability presence in WordPress installations.

Technical summary

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not properly sanitize and escape content submitted through an unauthenticated endpoint, leading to a Stored XSS vulnerability that could be used against high privilege users such as admin. This vulnerability is caused by inadequate input validation and sanitization, allowing attackers to inject malicious scripts into the plugin's output. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of admin pages to potential XSS attacks.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of admin pages to potential XSS attacks.

Recommended defensive actions

• Verify the version of the click5 CRM add-on to Gravity Forms WordPress plugin and update to a patched version if available.
• Assess exposure of admin pages to potential XSS attacks and implement additional security measures to prevent exploitation.
• Monitor for suspicious activity on WordPress installations that use the affected plugin.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being a WordPress plugin vulnerability report from WPScan. The vulnerability was reported through a responsible disclosure process, and the details are based on the information available from the reporter and the CVE Program. However, the exact scope and impact of the vulnerability are not explicitly stated, and defenders should verify the presence of this vulnerability in their WordPress installations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.