CVE-2026-84261 Overview
CVE-2026-84261 is a Stored Cross-Site Scripting (XSS) vulnerability in the click5 CRM add-on for the Contact Form 7 WordPress plugin, affecting versions up to and including 1.0.4. The plugin fails to sanitize and escape content submitted through an unauthenticated endpoint before rendering it in an administrative page. An unauthenticated attacker can inject malicious JavaScript that executes in the browser context of a high-privilege user, such as a WordPress administrator, when that user views the affected admin page. The flaw is tracked under CWE-79.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes under administrator sessions, enabling account takeover, backdoor installation, and full WordPress site compromise.
Affected Products
- click5 CRM add-on to Contact Form 7 WordPress plugin
- All versions through 1.0.4
- WordPress sites with the vulnerable add-on installed and active
Discovery Timeline
- 2026-10-11 - CVE-2026-84261 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-84261
Vulnerability Analysis
The vulnerability is a Stored XSS flaw rooted in missing output encoding and input sanitization. The click5 CRM add-on exposes an endpoint that accepts submissions without requiring authentication. Data from these submissions is persisted and later rendered in the WordPress administration interface. Because the plugin does not escape the stored content before echoing it into the admin page, attacker-controlled markup is interpreted as HTML and JavaScript by the administrator's browser.
Exploitation requires the administrator to visit the affected admin page, satisfying the user interaction requirement in the attack vector. Once triggered, the injected script runs with the administrator's cookies and privileges within the WordPress session.
Root Cause
The root cause is twofold: the plugin accepts unauthenticated input on a public endpoint, and it fails to apply WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() when rendering that input in the admin dashboard. This combination allows persistent script injection without any authentication barrier.
Attack Vector
An attacker sends a crafted request to the unauthenticated endpoint exposed by the click5 CRM add-on, embedding JavaScript payloads inside submitted fields. The payload is stored by the plugin and later rendered on an admin page. When an administrator opens that page, the browser executes the injected script. The script can create new administrator accounts, modify plugin files, exfiltrate nonces, or install persistent backdoors through the WordPress REST API.
No authenticated code example is published for this issue. Refer to the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-84261
Indicators of Compromise
- Unexpected administrator accounts or new users with elevated roles in wp_users and wp_usermeta tables.
- Submissions to the click5 CRM endpoint containing <script>, onerror=, onload=, or javascript: payloads in POST bodies.
- Modified theme or plugin files, especially functions.php, containing obfuscated PHP or remote code loaders.
- Outbound requests from administrator browsers to unfamiliar domains shortly after visiting the plugin admin page.
Detection Strategies
- Review web server access logs for POST requests to click5 CRM endpoints containing HTML tag characters or script-like strings.
- Query the database for CRM entries whose fields contain <, >, script, or event handler attributes.
- Monitor WordPress audit logs for user role changes, plugin installations, and option updates occurring after admin page visits.
Monitoring Recommendations
- Deploy a Web Application Firewall (WAF) rule set that blocks XSS payload patterns on Contact Form 7 and CRM add-on endpoints.
- Enable a WordPress activity logging plugin to record administrator actions, user creation, and settings changes.
- Alert on any modification to the wp_options table entries related to active plugins or user roles.
How to Mitigate CVE-2026-84261
Immediate Actions Required
- Deactivate and remove the click5 CRM add-on for Contact Form 7 until a patched release is confirmed available.
- Audit all WordPress administrator accounts and remove any users not explicitly authorized.
- Rotate administrator passwords and invalidate active sessions by updating WordPress secret keys in wp-config.php.
- Review stored CRM submission data and purge any entries containing script tags or HTML event handlers.
Patch Information
At the time of publication, the vulnerability affects the click5 CRM add-on through version 1.0.4. Review the WPScan Vulnerability Report for the latest vendor patch status and upgrade to a fixed release once published.
Workarounds
- Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer to limit administrator exposure.
- Apply a Content Security Policy (CSP) header that disallows inline scripts in the WordPress admin interface.
- Block requests to the vulnerable unauthenticated endpoint at the WAF until the plugin is updated or removed.
# Example: deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate click5-crm-cf7
wp plugin delete click5-crm-cf7
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
