Stored XSS Vulnerability in Gravity Forms Plugin by Click5
CVE-2026-84260
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 11 October 2026
Badges
What is CVE-2026-84260?
The Click5 CRM add-on for the Gravity Forms WordPress plugin is vulnerable to stored Cross-Site Scripting (XSS). This issue arises from the failure to properly sanitize and escape content submitted through an unauthenticated endpoint. Consequently, when this unverified input is outputted on an admin page, it could be exploited by attackers to execute malicious scripts, potentially targeting users with high privileges such as administrators. Proper mitigation measures are necessary to safeguard against these types of attacks.
Affected Version(s)
click5 CRM add-on to Gravity Forms 0 <= 1.0.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.