EUVD-2026-96756

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a...

EUVD-2026-96757

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84253

The click5 CRM add-on to Gravity Forms WordPress plugin, version 1.0.3 and below , is vulnerable to unauthenticated arbitrary options updates. The root cause is a lack of authorization and CSRF checks when updating options via a REST endpoint , combined with a failure to verify that the option be...

CVE-2026-84251

The click5 CRM add-on to Ninja Forms WordPress plugin (versions up to and including 1.0.1 ) is vulnerable to unauthenticated arbitrary options updates. The root cause is a lack of authorization and CSRF checks when updating options via a REST endpoint , combined with a failure to verify if the op...

CVE-2026-84252

The click5 CRM add-on to WPForms WordPress plugin (versions through 1.0.3 ) is vulnerable to an unauthenticated arbitrary options update . The flaw stems from a lack of authorization and CSRF checks when updating options via a REST endpoint , combined with a failure to verify that the updated opt...

CVE-2026-84254

The click5 CRM add-on to Contact Form 7 WordPress plugin (versions through 1.0.4 ) is vulnerable to an unauthenticated arbitrary options update . The root cause is a lack of authorization and CSRF checks on a REST endpoint, combined with a failure to verify that the updated option belongs to the ...

CVE-2026-84258

The click5 CRM add-on for the Ninja Forms WordPress plugin (versions up to and including 1.0.1 ) is vulnerable to Stored XSS . The flaw exists because the application fails to properly sanitize and escape content submitted through an unauthenticated endpoint before displaying it on an admin page....

CVE-2026-84258 click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84252 click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result,...

CVE-2026-84253 click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a...

CVE-2026-84254 click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a...

CVE-2026-84251 click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result,...

CVE-2026-108521

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

CVE-2026-108521 Studio-Saelix Sencho Add Remote Node API Endpoint validation.ts isValidRemoteUrl server-side request forgery

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

EUVD-2026-96728

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be execute...

CVE-2026-108521

A server-side request forgery (SSRF) vulnerability exists in Studio-Saelix Sencho up to version 0.97.1 . The flaw is located in the isValidRemoteUrl function within the backend/src/utils/validation.ts file of the Add Remote Node API Endpoint component. An authenticated user with node-management p...

CVE-2026-108704

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite...

CVE-2026-108704 CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite...

CVE-2026-108704 CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite...

EUVD-2026-96704

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite...