Veille CVE

Recherche « Unknown click5 CRM add-on to WPForms »

2 CVE

Critique 1 Élevée 1 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown click5 CRM add-on to WPForms » ✕
  1. CVE-2026-84259 8.8 Élevée

    Unknown click5 CRM add-on to WPForms

    The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.

  2. CVE-2026-84252 9.8 Critique

    Unknown click5 CRM add-on to WPForms

    The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.