The click5 CRM add‑on to Ninja Forms WordPress plugin, version 1.0.1 and earlier, contains an input handling weakness that fails to sanitise or escape data that comes from an unauthenticated endpoint. When this data is later displayed in the administration interface, scripts can be executed in the context of privileged users such as administrators. This stored cross‑site scripting flaw allows an attacker to inject arbitrary client‑side code.

Affected systems are installations of the click5 CRM add‑on for Ninja Forms on WordPress that are running version 1.0.1 or older. No specific platform versions are mentioned, but the weakness resides entirely in the plugin.

The vulnerability can be exploited remotely by any party able to reach the vulnerable endpoint, as it does not require authentication. The CVSS score of 8.8 indicates a high severity. The EPSS score of < 1% indicates a very low exploitation probability, and the issue is not currently listed in KEV. Nevertheless, the stored XSS payload could compromise administrator accounts and lead to credential theft, session hijacking, or defacement. Given the high impact on confidentiality and integrity for privileged users, the risk level is considered high.