CVE-2026-84261

Name of the Vulnerable Software and Affected Versions click5 CRM add-on to Contact Form 7 WordPress plugin versions prior to 1.0.5

Description An unauthenticated endpoint fails to sanitize and escape submitted content before it is displayed on an administrative page. This leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and executed in the browser of high-privilege users, such as administrators.

Recommendations Update the click5 CRM add-on to Contact Form 7 WordPress plugin to version 1.0.5 or later.