CVE-2026-84259: WPForms click5 CRM Add-on XSS Vulnerability

CVE-2026-84259 Overview

CVE-2026-84259 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the click5 CRM add-on for the WPForms WordPress plugin through version 1.0.3. The plugin accepts data through an unauthenticated endpoint and renders it in an administrator-facing page without proper sanitization or escaping. An unauthenticated attacker can inject JavaScript that executes when a high-privilege user, such as an administrator, views the affected admin page.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into the WordPress admin interface, enabling account takeover of administrators and full site compromise.

Affected Products

click5 CRM add-on for WPForms WordPress plugin
Versions through 1.0.3
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2026-10-11 - CVE-2026-84259 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-84259

Vulnerability Analysis

The vulnerability resides in an unauthenticated endpoint exposed by the click5 CRM add-on for WPForms. The endpoint accepts user-supplied input without applying WordPress sanitization functions. The stored content is later echoed back inside an administrator page without output escaping.

When an administrator loads the affected page, the injected payload executes in the browser session of a privileged user. This provides the attacker with the ability to perform any action available to the admin, including creating new administrator accounts, modifying plugins, or injecting a persistent backdoor.

Because the attack vector is network based and requires no authentication, exploitation can be fully automated at scale against WordPress sites running the plugin. The EPSS data available at publication indicates a probability score of 0.303%.

Root Cause

The root cause is missing input sanitization and output escaping on data flowing through an unauthenticated endpoint into an admin-rendered view. The plugin fails to apply standard WordPress helpers such as sanitize_text_field() on input and esc_html() or esc_attr() on output. This allows arbitrary HTML and JavaScript to persist in storage and later execute in the admin context.

Attack Vector

An unauthenticated remote attacker sends a crafted request to the vulnerable endpoint containing a JavaScript payload. The payload is stored by the plugin and later rendered inside the WordPress admin interface. User interaction is required because an administrator must visit the admin page where the injected content is displayed. Once triggered, the script runs with the administrator's session privileges.

For technical details of the vulnerable code path, see the WPScan Vulnerability Report.

Detection Methods for CVE-2026-84259

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror=, onload=), or encoded JavaScript stored in CRM-related database tables created by the plugin.
Creation of new WordPress administrator accounts not initiated by legitimate staff.
Unauthorized plugin or theme installations following admin page visits.
Outbound HTTP requests from administrator browser sessions to unknown domains after loading plugin admin pages.

Detection Strategies

Review web server logs for POST requests to the click5 CRM add-on endpoints originating from unauthenticated clients with payloads containing HTML or script syntax.
Audit the WordPress database for stored CRM entries containing <, >, javascript:, or encoded script fragments.
Monitor the WordPress audit log for administrator-initiated changes correlated with recent visits to the plugin's admin screens.

Monitoring Recommendations

Deploy a web application firewall rule that inspects submissions to the plugin endpoint for XSS payload patterns.
Enable file integrity monitoring on the wp-content/plugins/ directory and WordPress core files.
Alert on new user accounts created with the administrator role outside of change-management windows.

How to Mitigate CVE-2026-84259

Immediate Actions Required

Deactivate the click5 CRM add-on for WPForms until a patched version is released and verified.
Review all WordPress administrator accounts and remove any that cannot be attributed to a known user.
Rotate credentials and session tokens for all privileged WordPress users.
Inspect CRM data tables and remove any entries containing script content.

Patch Information

At the time of publication, no fixed version is identified in the available advisory data. All versions through 1.0.3 are affected. Monitor the WPScan Vulnerability Report and the plugin's official distribution channel for an updated release, and apply it immediately once available.

Workarounds

Remove or deactivate the plugin until a vendor patch is available.
Restrict access to WordPress admin pages using IP allow-listing at the web server or WAF layer.
Implement a strict Content Security Policy (CSP) on the WordPress admin interface to limit inline script execution.
Require administrators to use isolated browser profiles when managing WordPress sites to limit session reuse.

bash

# Example WAF rule to block script tags in requests to the plugin endpoint
# ModSecurity rule (illustrative)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,id:1008425,phase:2,deny,status:403,msg:'Potential XSS in click5 CRM add-on'"
  SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"