CVE-2026-124253: WordPress Calculated Fields Form plugin <= 5.5.2.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Calculated Fields Form calculated-fields-form allows DOM-Based XSS.This issue affects Calculated Fields Form: from n/a through 5.5.2.8.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/calculated-fields-formto a version that resolves this vulnerability.Fixed in 5.5.2.9
Event History
Frequently Asked Questions
Which installations are affected?
Calculated Fields Form versions through 5.5.2.8 are affected. The available information does not identify a safe fixed version.
What does an attacker need to exploit this issue?
The CVSS vector indicates the issue can be reached over the network with low attack complexity and no attacker privileges, but it requires user interaction. The vulnerability is DOM-based XSS, meaning exploitation depends on input being processed in a victim's browser.
What is the potential impact of successful exploitation?
Successful exploitation may affect confidentiality, integrity, and availability at a low level, with scope changed. This can allow attacker-controlled script execution in the affected web-page context.