WordPress Sitemap by click5 <1.0.36 - Missing Authorization

WordPress Sitemap by click5 plugin before 1.0.36 is susceptible to missing authorization. The plugin does not have authorization or CSRF checks when updating options via a REST endpoint and does not ensure that the option to be updated belongs to the plugin. An attacker can possibly obtain...

CVE-2022-0952

CVE-2022-0952 Sitemap by click5 1.0.36 - Unauthenticated Arbitrary Options Update Description The plugin does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated...

WordPress click5 CRM add-on to Contact Form 7 plugin <= 1.0.4 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to Contact Form 7 versions = 1.0.4...

WordPress click5 CRM add-on to Gravity Forms plugin <= 1.0.3 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to Gravity Forms versions = 1.0.3...

WordPress click5 CRM add-on to WPForms plugin <= 1.0.3 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to WPForms versions = 1.0.3...

WordPress click5 CRM add-on to Ninja Forms plugin <= 1.0.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to Ninja Forms versions = 1.0.1...

WordPress click5 CRM add-on to Contact Form 7 plugin <= 1.0.4 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin click5 CRM add-on to Contact Form 7 versions = 1.0.4...

WordPress click5 CRM add-on to WPForms plugin <= 1.0.3 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin click5 CRM add-on to WPForms versions = 1.0.3...

WordPress click5 CRM add-on to Ninja Forms plugin <= 1.0.1 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin click5 CRM add-on to Ninja Forms versions = 1.0.1...

CVE-2026-84261

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84258

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84260

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84253

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a...

CVE-2026-84254

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a...

CVE-2026-84259

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84252

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result,...

CVE-2026-84251

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result,...

EUVD-2026-96758

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...

CVE-2026-84259

The click5 CRM add-on for the WPForms WordPress plugin (versions through 1.0.3 ) is vulnerable to Stored XSS . The root cause is a failure to sanitize and escape content submitted via an unauthenticated endpoint before it is displayed on an admin page. This flaw allows an attacker to execute mali...

EUVD-2026-96760

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin...