CVE-2026-84258: click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications

Q: Who can exploit this issue, and who is at risk from the payload?

An attacker does not need authentication to submit malicious content through the affected endpoint. The stored payload becomes dangerous when a high-privilege user, such as an administrator, views the affected admin page.

Q: What conditions are required for exploitation?

Exploitation requires user interaction: an administrator or other privileged user must load the admin page where the submitted content is output. The vulnerability is network-accessible and has low attack complexity.

Q: Which versions are affected?

The issue affects the click5 CRM add-on to Ninja Forms WordPress plugin through version 1.0.1. The provided information does not identify a fixed version.

Published Oct 11, 2026

Updated

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.

Affected Software

1 affected component

click5 CRM add-on to Ninja Forms<=1.0.1

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the payload?

An attacker does not need authentication to submit malicious content through the affected endpoint. The stored payload becomes dangerous when a high-privilege user, such as an administrator, views the affected admin page.

What conditions are required for exploitation?

Exploitation requires user interaction: an administrator or other privileged user must load the admin page where the submitted content is output. The vulnerability is network-accessible and has low attack complexity.

Which versions are affected?

The issue affects the click5 CRM add-on to Ninja Forms WordPress plugin through version 1.0.1. The provided information does not identify a fixed version.

CVE-2026-84258: click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the payload?

What conditions are required for exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the payload?

What conditions are required for exploitation?

Which versions are affected?