The click5 CRM add‑on to Contact Form 7 plugin, for versions up to 1.0.4, fails to sanitise or escape data submitted through the unauthenticated post_notifications endpoint before rendering it in an administrator page. This creates a stored cross‑site scripting vulnerability that can be exploited to execute arbitrary JavaScript within the context of privileged WordPress users, potentially enabling credential theft and privilege escalation.

WordPress installations that have the click5 CRM add‑on to Contact Form 7 plugin installed at version 1.0.4 or earlier. The vulnerability applies to the default vendor identifier "click5 CRM add‑on to Contact Form 7", and no other products are listed as affected. Administrators should verify the plugin version and apply the fix if necessary.

The attack vector is unauthenticated and available over the network, allowing any user with access to the website to submit malicious payloads. Because the reflected content is displayed only on admin‑only pages, the impact is limited to users with elevated privileges. No EPSS data or KEV listing is available, but the CVSS score of 8.8 indicates a high severity level. The vulnerability can be promptly attacked by external actors until the plugin is updated or the endpoint is disabled.