click5 CRM add-on to Ninja Forms: Stored XSS via unauthenticated endpoint
Summary
The click5 CRM add-on for the Ninja Forms WordPress plugin does not sanitise or escape data submitted through an unauthenticated endpoint before displaying it on an admin page. An unauthenticated attacker can store script code that runs in the browser of a logged-in user with high privileges, such as an administrator, when that user views the affected page. Successful exploitation could allow an attacker to take over an administrator account.
Affected
- click5 CRM add-on to Ninja Forms through version 1.0.1
- Ninja Forms core is not listed as affected
Fixed in
Unknown. WPScan lists no known fix. Check the WordPress.org plugin page for a patched release.
Workaround
- Deactivate and remove the add-on if the click5 CRM link is not required
- Restrict access to the WordPress admin area
- Review CRM-fed entries and admin-page output for injected script
Exploitation
- CISA SSVC: exploitation none, automatable no
- Not listed in CISA KEV
- No reports of in-the-wild exploitation found
- Public proof of concept: unknown
Our recommendation
- Check whether the click5 CRM add-on is installed on your WordPress sites
- Remove the add-on if it is not needed; otherwise apply a vendor update once available and add compensating controls
- Limit the number of administrator accounts and enable two-factor authentication
- Check the sibling issue CVE-2026-84251 in the same add-on at the same time
- Monitor the vendor and WPScan for a fix
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability page wpscan.com
- OpenCVE CVE-2026-84258 app.opencve.io
- Vulnrichment CVE-2026-84258 vulners.com
- click5 CRM add-on plugin page discover.commoninja.com
- Strix CVE-2026-84251 (related issue) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:42.
Original description (NVD)
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.