CVE-2026-95529: WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Calculated Fields Form pluginto a version that resolves this vulnerability.Fixed in 5.5.1.2
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or plugin-specific privileges. Exploitation still requires user interaction, as indicated by the UI:R vector.
Which plugin versions are affected?
Calculated Fields Form versions up to and including 5.5.1.1 are affected. The provided data does not identify a fixed version.
What impact can successful exploitation have?
Successful XSS can affect confidentiality, integrity, and availability at low impact levels. The scope is changed, meaning the impact may extend beyond the vulnerable plugin's own security authority.