Unknown CLICK5 CRM Add-On To Ninja Forms vulnerabilities

2 CVEs affecting Unknown CLICK5 CRM Add-On To Ninja Forms, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-84258, published 2026-10-11.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-84258, published 2026-10-11. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page,…
• CVE-2026-84251, published 2026-10-11. Critical severity, CVSS 9.8. EPSS: 0.2% chance of exploitation in the next 30 days. The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be…