The click5 CRM add‑on for WPForms allows unauthenticated users to submit data through the post_notifications endpoint without proper sanitization, resulting in a stored Cross‑Site Scripting vulnerability. Because the injected payload is stored and later rendered in an administrative page, an attacker can execute arbitrary JavaScript in the context of any admin user who visits that page. This could lead to session hijacking, credential theft, or the execution of further malicious actions. The weakness corresponds to improper input validation and XSS.

The affected product is the click5 CRM add‑on for WPForms, a WordPress plugin variant, for all releases up to and including version 1.0.3. No other vendors or product versions are specifically identified. The vulnerability resides in the post_notifications handling logic of the add‑on.

The vulnerability has a CVSS score of 8.8. The EPSS score of 0.00167 indicates a very low probability of exploitation in the wild, but the stored XSS flaw remains high risk because it does not require authentication to inject and applies to privileged admin sessions when the page is accessed. It is not listed in the CISA KEV catalog. The likely attack vector is via an unauthenticated HTTP POST to the plugin’s post_notifications endpoint, which stores the payload and subsequently renders it in an admin area. Consequently, the risk level is significant for all sites running the vulnerable add‑on.