CVE-2026-84261: click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications

Q: Who can submit the malicious content?

The vulnerable endpoint is unauthenticated, so an attacker does not need a WordPress account or other credentials to submit content.

Q: What is required for the stored XSS to affect an administrator?

A high-privilege user such as an administrator must view the affected admin page where the submitted content is output. The CVSS vector indicates user interaction is required.

Q: Which versions are affected?

The issue affects click5 CRM add-on to Contact Form 7 through version 1.0.4.

Published Oct 11, 2026

Updated

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.

Affected Software

1 affected component

click5 CRM add-on to Contact Form 7<=1.0.4

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can submit the malicious content?

The vulnerable endpoint is unauthenticated, so an attacker does not need a WordPress account or other credentials to submit content.

What is required for the stored XSS to affect an administrator?

A high-privilege user such as an administrator must view the affected admin page where the submitted content is output. The CVSS vector indicates user interaction is required.

Which versions are affected?

The issue affects click5 CRM add-on to Contact Form 7 through version 1.0.4.

CVE-2026-84261: click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications

Affected Software

Event History

Frequently Asked Questions

Who can submit the malicious content?

What is required for the stored XSS to affect an administrator?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can submit the malicious content?

What is required for the stored XSS to affect an administrator?

Which versions are affected?