CVE-2026-84258: CWE-79 Cross-Site Scripting (XSS) in click5 CRM add-on to Ninja Forms

The click5 CRM add-on to Ninja Forms WordPress plugin versions up to and including 1.0.1 contain a stored XSS vulnerability (CWE-79). The issue occurs because content submitted through an unauthenticated endpoint is not sanitized or escaped before being output on an administrative interface. This could enable an attacker to inject malicious scripts that execute in the browsers of admin users viewing the affected page.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of an administrator's browser session. This may lead to session hijacking, privilege escalation, or other malicious actions performed with admin privileges. The vulnerability affects only users with high privilege roles who access the affected admin page.

No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict access to the affected admin pages to trusted users only and consider disabling the click5 CRM add-on if feasible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.