CVE-2026-84260: Gravity Forms click5 CRM XSS Vulnerability

CVE-2026-84260 Overview

CVE-2026-84260 is a Stored Cross-Site Scripting (XSS) vulnerability in the click5 CRM add-on for the Gravity Forms WordPress plugin, affecting versions through 1.0.3. The plugin fails to sanitize and escape content submitted through an unauthenticated endpoint before rendering it inside an administrative page. An unauthenticated attacker can inject malicious JavaScript that executes when a high-privilege user, such as an administrator, views the affected admin screen. Successful exploitation can hijack administrator sessions, perform actions on behalf of the admin, or deliver secondary payloads against the WordPress site.

Critical Impact
Unauthenticated attackers can store JavaScript payloads that execute in the browser of a WordPress administrator, enabling account takeover and site compromise.

Affected Products

click5 CRM add-on for Gravity Forms (WordPress plugin)
All versions through and including 1.0.3
WordPress sites exposing the vulnerable unauthenticated endpoint

Discovery Timeline

2026-10-11 - CVE-2026-84260 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-84260

Vulnerability Analysis

The vulnerability is a Stored XSS flaw classified under [CWE-79]. The click5 CRM add-on exposes an endpoint that accepts user-supplied input without requiring authentication. The plugin stores the submitted content and later renders it in an administrative page without applying output escaping or input sanitization. When a WordPress administrator loads the affected admin view, the injected script runs in the context of the admin session. Because the injection point is reachable without credentials and the payload fires in a privileged browser context, the impact extends to full administrative compromise of the WordPress installation.

Root Cause

The plugin omits two standard WordPress hardening steps. First, it does not call sanitization helpers such as sanitize_text_field() or wp_kses_post() on data received through the unauthenticated endpoint. Second, it does not apply contextual escaping functions such as esc_html(), esc_attr(), or esc_js() when echoing the stored values into admin markup. This dual failure allows raw HTML and JavaScript to persist in the database and reach the Document Object Model (DOM) unchanged.

Attack Vector

An attacker sends a crafted HTTP request containing a JavaScript payload to the vulnerable public endpoint exposed by the plugin. The payload is stored by the application. When an administrator subsequently navigates to the admin page that renders this data, the browser executes the attacker-controlled script. The script runs with the privileges of the authenticated admin user, enabling actions such as creating new administrator accounts, modifying plugin or theme files, or exfiltrating session cookies and nonces. For technical details, see the WPScan Vulnerability Report.

Detection Methods for CVE-2026-84260

Indicators of Compromise

Unexpected <script> tags, event handlers (onerror, onload), or javascript: URIs stored in click5 CRM database tables.
Creation of new WordPress administrator accounts without a corresponding audit trail.
Unauthorized modifications to plugin, theme, or wp_options records shortly after an admin session.
Outbound HTTP requests from administrator browsers to unfamiliar domains while viewing CRM admin pages.

Detection Strategies

Inspect HTTP POST request bodies to the plugin's unauthenticated endpoints for HTML tags, encoded script fragments, or template injection patterns.
Review database rows populated by the click5 CRM add-on for raw HTML or script content that should contain plain text.
Correlate anomalous admin activity (user creation, option changes) with recent visits to CRM admin pages.

Monitoring Recommendations

Enable web application firewall (WAF) logging for all requests to /wp-admin/ and plugin endpoints registered by click5 CRM.
Monitor WordPress audit logs for new admin users, role changes, and plugin or theme file edits.
Alert on Content Security Policy (CSP) violations originating from admin pages.

How to Mitigate CVE-2026-84260

Immediate Actions Required

Deactivate and remove the click5 CRM add-on for Gravity Forms until a patched release is available.
Audit WordPress users and remove any administrator accounts that cannot be attributed to a known administrator.
Rotate credentials and reset sessions for all WordPress administrators who accessed CRM admin pages.
Review and restore plugin, theme, and configuration files from a trusted backup if tampering is suspected.

Patch Information

No patched version is referenced in the enriched CVE data. The vulnerability affects the plugin through version 1.0.3. Monitor the WPScan Vulnerability Report and the plugin vendor's advisories for an updated release that enforces input sanitization and output escaping on the affected endpoint.

Workarounds

Block requests to the plugin's unauthenticated endpoint at the WAF or reverse proxy until a fix is published.
Restrict access to /wp-admin/ by source IP address where operationally feasible.
Deploy a strict Content Security Policy on WordPress admin pages to limit inline script execution.
Enforce multi-factor authentication (MFA) for all WordPress administrator accounts to limit the impact of session theft.

bash

# Example: block requests to the vulnerable plugin path at nginx
location ~* /wp-content/plugins/click5-crm/ {
    deny all;
    return 403;
}