The click5 CRM add‑on for Gravity Forms allows an attacker to submit arbitrary content through an unauthenticated endpoint before it is displayed in an admin page, creating a stored cross‑site scripting flaw that can be exploited by users with high privileges such as administrators. The vulnerability arises from a failure to sanitise and escape user input, which meets the definition of a stored XSS flaw. When exploited, the attacker could execute malicious scripts in the admin context, potentially leading to session hijacking, credential theft, or the deployment of further malware within the compromised site.

WordPress sites that install the click5 CRM add‑on for Gravity Forms versions up to and including 1.0.3 are affected. The issue is linked to the post_notifications endpoint exposed by the add‑on, and no other versions beyond 1.0.3 are mentioned as vulnerable.

The CVSS score for this vulnerability is 8.8, indicating a high severity level. The EPSS estimate is 0.00167 and the vulnerability is not listed in the CISA KEV catalogue, so the precise exploitation likelihood remains uncertain. Nonetheless, the flaw is exploitable by any actor who can send a crafted request to the add‑on endpoint, which is unauthenticated and publicly reachable. Successful exploitation would affect every administrator who views the affected admin page, giving the attacker the same level of privileges as the admin user. While we cannot precisely quantify risk, the potential impact is high for sites that rely on the click5 CRM add‑on.