PT-2026-110031

CVE-2026-84258

Published

2026-10-11

Updated

2026-10-16

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Ninja Forms WordPress plugin versions prior to 1.0.2

Description An unauthenticated endpoint fails to sanitize and escape submitted content before it is displayed on an administrative page. This leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and executed in the browser of high-privilege users, such as administrators.

Recommendations Update the click5 CRM add-on to Ninja Forms WordPress plugin to version 1.0.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Erwan Lr

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers