{"error":0,"message":null,"data":{"name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More","plugin":"calculated-fields-form","link":"https:\/\/wordpress.org\/plugins\/calculated-fields-form\/","latest":"1789680420","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"e65ae20ad82708bb83ac0cbfc81c410bed4a39060e26903327229dea273ddead","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 1.0.354","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.0.354","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2020-7228","name":"CVE-2020-7228","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2020-7228","description":"[en] The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user.","date":"2020-01-22"},{"id":"68d411c6977556b3e5f21da55515cb9ec6bb269a","name":"WordPress Calculated Fields Form plugin <= 1.0.353 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/calculated-fields-form\/vulnerability\/wordpress-calculated-fields-form-plugin-1-0-353-authenticated-stored-cross-site-scripting-xss-vulnerability","description":"Authenticated Stored Cross-Site Scripting (XSS) vulnerability found by Ben Armstrong (Spider Sec Ltd) in WordPress Calculated Fields Form plugin (versions <= 1.0.353).","date":"2020-01-22"},{"id":"7f7f9c1c-39af-4494-a3de-eb8fb5728cb1","name":"Calculated Fields Form &lt; 1.0.354 - Authenticated Stored XSS","link":"https:\/\/wpscan.com\/vulnerability\/7f7f9c1c-39af-4494-a3de-eb8fb5728cb1","description":"An authenticated user with access to edit or create Calculated Fields Form content can inject javascript into input fields such as &lsquo;field name&rsquo; and &lsquo;form name&rsquo;.","date":null},{"id":"529373b43e5f0c7bd02880405f70374dd5915637","name":"Calculated Fields Form <= 1.0.353 - Authenticated Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-10353-authenticated-stored-cross-site-scripting","description":"The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user.","date":"2020-01-22"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"5.4","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"3094d71bad28e1890c09db73010adda79fa94612c4437b1c3df2d97b6b78f3e4","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 1.0.11","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.0.11","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"f95b5609675c2f93f641ff1fedcd36aa6fc9bf85","name":"WordPress Calculated Fields Form Plugin <= 1.0.10 - Remote SQL Injection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/calculated-fields-form\/vulnerability\/wordpress-calculated-fields-form-plugin-1-0-10-remote-sql-injection","description":"Calculated Fields Form plugin is prone to a remote SQL injection vulnerability that allows an attacker to execute SQL queries into database.\nUpgrade the plugin.","date":"2015-03-02"}],"impact":[]},{"uuid":"05ab7d4aa2c3def3ce7c9e7e1d82feca2726f307785b5cb662a62cde582d9cb3","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 1.0.12","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.0.12","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"594644fe-b2df-4137-a4b3-aeef6e7740c8","name":"Calculated Fields Form &lt;= 1.0.10 - SQL Injection via CSRF","link":"https:\/\/wpscan.com\/vulnerability\/594644fe-b2df-4137-a4b3-aeef6e7740c8","description":"The Calculated Fields Form WordPress plugin was affected by a SQL Injection via CSRF security vulnerability.","date":null}],"impact":[]},{"uuid":"b830cb83e05b5ccf7f461137b24d5254963a0ffc888412f3151529c1345bafb4","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 1.0.12","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.0.12","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"c5e1c4cb0513b4ffb19bbafad9545047437462ab","name":"Calculated Fields Form <= 1.0.11 - Cross-Site Request Forgery to SQL Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-1011-cross-site-request-forgery-to-sql-injection","description":"The Calculated Fields Form plugin for WordPress is vulnerable to SQL Injection via Cross-Site Request Forgery in versions up to, and including, 1.0.11 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","date":"2015-03-02"}],"impact":[]},{"uuid":"07ea48b9795dc2961809ab6c88376eaed17718a7efa8b731e2dcf96d6ba3944d","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 1.1.151","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.1.151","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-0389","name":"CVE-2023-0389","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-0389","description":"[en] The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)","date":"2024-01-16"},{"id":"cb2583d4198fb8df94e28a2d3f2a5b207ccdbb22","name":"Calculated Fields Form <= 1.1.150 - Authenticated (Administrator+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-11150-authenticated-administrator-stored-cross-site-scripting","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.1.150 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2023-02-22"},{"id":"090a3922-febc-4294-82d2-d8339d461893","name":"Calculated Fields Form &lt; 1.1.151 - Admin+ Stored Cross-Site Scripting via Dropdown Fields","link":"https:\/\/wpscan.com\/vulnerability\/090a3922-febc-4294-82d2-d8339d461893","description":"The plugin does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)\r\n\r\nPartial fixes were implemented in versions 1.1.148, 1.1.150, and 1.1.151.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"4.8","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"4.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"7f297ba80509b6193b73b21f805c2fd3536f16d5cf8ca5e7b70d85184b23cd25","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 1.1.121","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.1.121","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-26523","name":"CVE-2023-26523","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-26523","description":"[en] Missing Authorization vulnerability in CodePeople Calculated Fields Form allows Functionality Misuse.This issue affects Calculated Fields Form: from n\/a through 1.1.120.","date":"2024-06-03"},{"id":"2a897a250f8a4034018d93cab1b28fab0d2c7559","name":"Calculated Fields Form <= 1.1.120 - Cross-Site Request Forgery","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-11120-cross-site-request-forgery","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.120. This is due to missing or incorrect nonce validation on the feedback_action function. This makes it possible for unauthenticated attackers to leave plugin feedback on the site owner's behalf via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2023-03-02"},{"id":"79fb3397138a8ab582a0dfe05fadcd8892e9ce5a","name":"Calculated Fields Form <= 1.1.120 - Missing Authorization to Feedback Submission","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-11120-missing-authorization-to-feedback-submission","description":"The Calculated Fields Form plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the feedback_action function in versions up to, and including, 1.1.120. This makes it possible for authenticated attackers with subscriber-level access to provide plugin feedback on the site owner's behalf.","date":"2023-02-28"},{"id":"9f2ecff09ce507c846cb5120e8e75159f6770761","name":"WordPress  Calculated Fields Form Plugin  <= 1.1.120 is vulnerable to Other Vulnerability Type","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/calculated-fields-form\/vulnerability\/wordpress-calculated-fields-form-plugin-1-1-120-missing-authorization-leading-to-feedback-submission-vulnerability","description":"Update the WordPress Calculated Fields Form plugin to the latest available version (at least 1.1.121).\nLana Codes discovered and reported this Other Vulnerability Type vulnerability in WordPress Calculated Fields Form Plugin.  This vulnerability has been fixed in version 1.1.121.","date":"2023-02-28"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"3592b12f392ca8a2172c2e95f759e2f338f41fc982c7263eec890b904b6cebbb","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 1.2.41","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.2.41","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-6446","name":"CVE-2023-6446","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-6446","description":"[en] The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2024-01-11"},{"id":"1788cee4b638a9fafa6f31ba7f1dcd36554ad199","name":"Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-1240-authenticated-admin-stored-cross-site-scripting","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2023-12-05"},{"id":"67fb8915fbc021e56c440217dfb6f1bd97bf78a8","name":"WordPress  Calculated Fields Form Plugin  <= 1.2.40 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/calculated-fields-form\/vulnerability\/wordpress-calculated-fields-form-plugin-1-2-40-authenticated-admin-stored-cross-site-scripting-vulnerability","description":"Update the WordPress Calculated Fields Form plugin to the latest available version (at least 1.2.41).\nemad discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Calculated Fields Form Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 1.2.41.","date":"2023-12-06"},{"id":"39c391a1-a7b2-47a3-928b-99fed5ee69fa","name":"Calculated Fields Form &lt; 1.2.41 - Authenticated (Admin+) Stored Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/39c391a1-a7b2-47a3-928b-99fed5ee69fa","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"4.8","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"4.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."},{"cwe":"CWE-87","name":"Improper Neutralization of Alternate XSS Syntax","description":"The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"9725b315ce645e1b251deabc4ecd9f051aabb74b77ade4bea842838454132f9a","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 1.2.29","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.2.29","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-51517","name":"CVE-2023-51517","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-51517","description":"[en] URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.This issue affects Calculated Fields Form: from n\/a through 1.2.28.","date":"2023-12-29"},{"id":"4b313b4922d1da7a597a7968a6776cf1df4a25f8","name":"WordPress  Calculated Fields Form Plugin  <= 1.2.28 is vulnerable to Open Redirection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/calculated-fields-form\/vulnerability\/wordpress-calculated-fields-form-plugin-1-2-28-open-redirection-via-shortcode-vulnerability","description":"Update the WordPress Calculated Fields Form plugin to the latest available version (at least 1.2.29).\nNg\u00f4 Thi\u00ean An (ancorn_ from VNPT-VCI) discovered and reported this Open Redirection vulnerability in WordPress Calculated Fields Form Plugin. This could allow a malicious actor to redirect users from one site to the other due to the redirect URL not being validated. Users could be tricked to visiting a legitimate site to then be redirected to a malicious site and cause a phishing incident. This vulnerability has been fixed in version 1.2.29.\nHave additional information or questions about this entry? Get in touch.","date":"2024-12-27"},{"id":"4c925859abb3d2804020956fcb6e1e312c2553d5","name":"Calculated Fields Form <= 1.2.28 - Authenticated (Contributor+) Open Redirect via Shortcode","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-1228-authenticated-contributor-open-redirect-via-shortcode","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Open Redirect via the plugin's shortcode(s) in all versions up to 1.2.29 (exclusive) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to redirect users when they visit an injected page.","date":"2023-12-27"},{"id":"c00be642-fd70-409b-8c5f-56ab54e51286","name":"Calculated Fields Form &lt; 1.2.29 - Contributor+ Open Redirect","link":"https:\/\/wpscan.com\/vulnerability\/c00be642-fd70-409b-8c5f-56ab54e51286","description":"The plugin does not validate a shortcode attribute, which could allow Contributor and above role to perform Open Redirect attack","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"n","a":"n","score":"4.1","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:N\/A:N","score":"4.1","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"none","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-601","name":"URL Redirection to Untrusted Site ('Open Redirect')","description":"The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"603335999d7c6e64faec5c30a9deffd91a731443d9b36605f5e001bbc13ca90f","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 1.2.53","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.2.53","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-0963","name":"CVE-2024-0963","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-0963","description":"[en] The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping on user supplied 'location' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-02-02"},{"id":"d8c7638decd2f0aebf43682e4f90c234fae9d1a9","name":"Calculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-1252-authenticated-contributor-stored-cross-site-scripting","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping on user supplied 'location' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2024-02-01"},{"id":"4076afd4cb4da0290c13a8da6d5bbfba616d2758","name":"WordPress  Calculated Fields Form Plugin  <= 1.2.52 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/calculated-fields-form\/vulnerability\/wordpress-calculated-fields-form-plugin-1-2-52-authenticated-contributor-stored-cross-site-scripting-vulnerability","description":"Update the WordPress Calculated Fields Form plugin to the latest available version (at least 1.2.53).\nRichard Telleng (stueotue) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Calculated Fields Form Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 1.2.53.\nHave additional information or questions about this entry? Get in touch.","date":null},{"id":"71b12ab7-94d6-45a1-937f-240a0fa604eb","name":"Calculated Fields Form &lt; 1.2.53 - Contributor+ Stored XSS","link":"https:\/\/wpscan.com\/vulnerability\/71b12ab7-94d6-45a1-937f-240a0fa604eb","description":"The plugin does not validate and escape some the location attribute of its CP_CALCULATED_FIELDS shortcode before outputting it back in a page\/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"5.4","severity":"m","exploitable":"2.3","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"5.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.3","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"5cb91cdf2c95c935c0b93c69968b43b97cac264994e7cae75c9c041b7c155abb","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 5.1.57","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.1.57","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-2020","name":"CVE-2024-2020","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-2020","description":"[en] The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and including, 5.1.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the professional version or higher.","date":"2024-03-13"},{"id":"16c9c0424bff551b8a05bd43069f6131e87e42c3","name":"Calculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-professional-5156-unauthenticated-stored-cross-site-scripting","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and including, 5.1.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the professional version or higher.","date":"2024-03-01"},{"id":"2dd9ce14765e838da19bec56995866af8b6236db","name":"WordPress  Calculated Fields Form Plugin    5.0.0-5.1.56 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/calculated-fields-form\/vulnerability\/wordpress-calculated-fields-form-professional-plugin-5-1-56-unauthenticated-stored-cross-site-scripting-vulnerability","description":"Update the WordPress Calculated Fields Form plugin to the latest available version (at least 5.1.57).\nAsaf Mozes discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Calculated Fields Form Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 5.1.57.\nHave additional information or questions about this entry? Get in touch.","date":null},{"id":"5dd9084f-d2dc-4446-928f-883060fc1bc1","name":"Calculated Fields Form Professional &lt; 5.1.57 - Unauthenticated Stored Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/5dd9084f-d2dc-4446-928f-883060fc1bc1","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and including, 5.1.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the professional version or higher.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"6.1","severity":"m","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"6.1","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"d9522b31fa087fa620c2a1dc34514abf74572dd13f63b7cb7b986b69389e0f25","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 1.2.55","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.2.55","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-29759","name":"CVE-2024-29759","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-29759","description":"[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Calculated Fields Form allows Reflected XSS.This issue affects Calculated Fields Form: from n\/a through 1.2.54.","date":"2024-03-27"},{"id":"d6f4314bbd30c1564bb21de40a30a65d62e740d6","name":"WordPress  Calculated Fields Form Plugin    <= 1.2.54 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/calculated-fields-form\/vulnerability\/wordpress-calculated-fields-form-plugin-1-2-54-reflected-cross-site-scripting-xss-vulnerability","description":"Update the WordPress Calculated Fields Form plugin to the latest available version (at least 1.2.55).\nRafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Calculated Fields Form Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 1.2.55.\nThis vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance.\nHave additional information or questions about this entry? Get in touch.","date":null},{"id":"27b615f1a0ca39feba79bb55c854c65448247c97","name":"Calculated Fields Form <= 1.2.54 - Reflected Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-1254-reflected-cross-site-scripting","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":"2024-03-25"},{"id":"ff4a00cc-76e1-4bcb-a751-c4aa56aab56c","name":"Calculated Fields Form &lt; 1.2.55 - Reflected Cross-Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/ff4a00cc-76e1-4bcb-a751-c4aa56aab56c","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"n","ui":"r","s":"c","c":"l","i":"l","a":"l","score":"7.1","severity":"h","exploitable":"2.8","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:L","score":"7.1","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"changed","c":"low","i":"low","a":"low","exploitable":"2.8","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"f526fa4439864a79d1fb0cac877754f7edcf2cc76b32b124381624af6c1aeeb9","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 5.2.46","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.46","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-9940","name":"CVE-2024-9940","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-9940","description":"[en] The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not properly neutralizing HTML elements from submitted forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views form submissions in their email.","date":"2024-10-17"},{"id":"a4f46609f10334bce7d807cb37777cbb20373f19","name":"Calculated Fields Form <= 5.2.45 - HTML Injection","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-5245-html-injection","description":"The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not properly neutralizing HTML elements from submitted forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views form submissions in their email.","date":"2024-10-16"},{"id":"8120563b6390214606551e7254d33962d9497baf","name":"WordPress Calculated Fields Form Plugin <= 5.2.45 is vulnerable to Content Injection","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/calculated-fields-form\/vulnerability\/wordpress-calculated-fields-form-plugin-5-2-45-html-injection-vulnerability","description":"<p>WordPress Calculated Fields Form Plugin <= 5.2.45 is vulnerable to Content Injection<\/p><p>Software: Calculated Fields Form<\/p><p>Link: https:\/\/wordpress.org\/plugins\/calculated-fields-form\/#developers<\/p><p>Affected Version <= 5.2.45<\/p><p>Fixed in version 5.2.46 <\/p>","date":"2024-10-16"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"n","i":"l","a":"n","score":"4.3","severity":"m","exploitable":"2.8","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N","score":"4.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"none","i":"low","a":"none","exploitable":"2.8","impact":"1.4"},"cwe":[{"cwe":"CWE-75","name":"Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)","description":"The product does not adequately filter user-controlled input for special elements with control implications."},{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"ca232023180909eeb621c86f9ae860092506563d072ea2f8e94f69b4a717381a","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 5.2.64","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.64","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-12601","name":"CVE-2024-12601","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-12601","description":"[en] The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited height and width parameters for CAPTCHA images. This makes it possible for unauthenticated attackers to send multiple requests with large values, resulting in slowing server resources if the server does not mitigate Denial of Service attacks.","date":"2024-12-17"},{"id":"0f335e9d2ff6d0d9280ec510bc5aa6305cb7624d","name":"Calculated Fields Form <= 5.2.63 - Denial of Service","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-5263-denial-of-service","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited height and width parameters for CAPTCHA images. This makes it possible for unauthenticated attackers to send multiple requests with large values, resulting in slowing server resources if the server does not mitigate Denial of Service attacks.","date":"2024-12-16"},{"id":"3802d0431e19afe11d52bd1c7794d4e54236b0fc","name":"WordPress Calculated Fields Form Plugin <= 5.2.63 is vulnerable to Denial of Service Attack","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/calculated-fields-form\/vulnerability\/wordpress-calculated-fields-form-plugin-5-2-63-denial-of-service-vulnerability","description":"<p>WordPress Calculated Fields Form Plugin <= 5.2.63 is vulnerable to Denial of Service Attack<\/p><p>Software: Calculated Fields Form<\/p><p>Fixed in version 5.2.64 <\/p><p>Affected Version <= 5.2.63<\/p><p>CVE: CVE-2024-12601<\/p>","date":"2024-12-17"},{"id":"EUVD-2024-50991","name":"EUVD-2024-50991","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2024-50991","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited height and width parameters for CAPTCHA images. This makes it possible for unauthenticated attackers to send multiple requests with large values, resulting in slowing server resources if the server does not mitigate Denial of Service attacks.","date":"2024-12-17"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:L","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"n","i":"n","a":"l","score":"5.3","severity":"m","exploitable":"3.9","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:L","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"none","i":"none","a":"low","exploitable":"3.9","impact":"1.4"},"cwe":[{"cwe":"CWE-400","name":"Uncontrolled Resource Consumption","description":"The product does not properly control the allocation and maintenance of a limited resource."}],"ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null},"epss":"0.004"}},{"uuid":"19df496e6a344d69f55c65cd73a9e0dc508f16e1bc4183465cbcfb0294ee709a","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 5.2.62","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.62","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-12273","name":"CVE-2024-12273","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-12273","description":"[en] The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":"2025-04-29"},{"id":"b2f67f53266460d0d3907bece2e3b7a595b28c44","name":"Calculated Fields Form <= 5.2.61 - Authenticated (Admin+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-5261-authenticated-admin-stored-cross-site-scripting","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.2.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2025-04-08"},{"id":"EUVD-2024-54516","name":"EUVD-2024-54516","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2024-54516","description":"The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":"2025-04-29"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:U\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"u","c":"l","i":"l","a":"n","score":"3.5","severity":"l","exploitable":"0.9","impact":"2.5"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:U\/C:L\/I:L\/A:N","score":"3.5","severity":"low","av":"network","ac":"low","pr":"high","ui":"required","s":"unchanged","c":"low","i":"low","a":"none","exploitable":"0.9","impact":"2.5"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"4081bc17dc2c9573873e612ed9f1c565e666244595c0c0de86569dc6c38b1711","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 5.2.62","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.62","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-13381","name":"CVE-2024-13381","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-13381","description":"[en] The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":"2025-05-01"},{"id":"EUVD-2025-13285","name":"EUVD-2025-13285","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-13285","description":"The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":"2025-05-01"},{"id":"29b34a4c6a318a8f818be04788b05072ef0b64bb","name":"Calculated Fields Form <= 5.2.61 - Authenticated (Admin+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-5261-authenticated-admin-stored-cross-site-scripting-1","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.2.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2025-04-09"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"4.8","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"4.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"2c11afbc1a6bcae518c9b12d36e7895835180f0bb9747b761273b32ca4c8dedb","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 5.2.64","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.2.64","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-13382","name":"CVE-2024-13382","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-13382","description":"[en] The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":"2025-05-15"},{"id":"EUVD-2025-15296","name":"EUVD-2025-15296","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-15296","description":"The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).","date":"2025-05-15"},{"id":"c8784df5ea75a44cba3c5bd2e9caa0ced4df5829","name":"Calculated Fields Form <= 5.2.63 - Authenticated (Admin+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-5263-authenticated-admin-stored-cross-site-scripting","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.2.63 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2025-03-02"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"4.8","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"4.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null},"epss":"0.001"}},{"uuid":"b8de076b10f1b031c28d3d43f14651720643115cd111b0cc05a04c5623b1fd63","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 5.3.59","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.3.59","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-49291","name":"CVE-2025-49291","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-49291","description":"[en] Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form allows Cross Site Request Forgery. This issue affects Calculated Fields Form: from n\/a through 5.3.58.","date":"2025-06-06"},{"id":"b1ef93384444272a8c1912c187535d9ba000bac6","name":"Calculated Fields Form <= 5.3.58 - Cross-Site Request Forgery","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-5358-cross-site-request-forgery","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3.58. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.","date":"2025-06-05"},{"id":"EUVD-2025-17271","name":"EUVD-2025-17271","link":"https:\/\/euvd.enisa.europa.eu\/enisa\/EUVD-2025-17271","description":"Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form allows Cross Site Request Forgery. This issue affects Calculated Fields Form: from n\/a through 5.3.58.","date":"2025-06-06"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"r","s":"u","c":"h","i":"h","a":"h","score":"8.8","severity":"h","exploitable":"2.8","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:H\/I:H\/A:H","score":"8.8","severity":"high","av":"network","ac":"low","pr":"none","ui":"required","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"2.8","impact":"5.9"},"cwe":[{"cwe":"CWE-352","name":"Cross-Site Request Forgery (CSRF)","description":"The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"6dcf2de2e34ae44f7450b58a1509aad21d4aeef528a4218a72474a51589dd0bf","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 5.4.4.2","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.4.4.2","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-25368","name":"CVE-2026-25368","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-25368","description":"[en] Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Calculated Fields Form: from n\/a through <= 5.4.4.1.","date":"2026-02-19"},{"id":"8700210b2b6900a044f3ce8e8da8ca585763fe7a","name":"Calculated Fields Form <= 5.4.4.1 - Missing Authorization","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-5441-missing-authorization","description":"The Calculated Fields Form plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.4.4.1. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.","date":"2026-02-16"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"h","i":"n","a":"n","score":"6.5","severity":"m","exploitable":"2.8","impact":"3.6"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:N\/A:N","score":"6.5","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"unchanged","c":"high","i":"none","a":"none","exploitable":"2.8","impact":"3.6"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"ab5195cefee48c545a0ce2d8796b230d89d5d14d9c2ba710263df1e1f4aada23","name":"Calculated Fields Form &#8211; AI Form Builder for WordPress &#8211; Contact, Payment, Quote, Quiz &amp; More [calculated-fields-form] < 5.4.5.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"5.4.5.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-3986","name":"Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-3986","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5.0. This is due to insufficient capability checks on the form settings save handler and insufficient input sanitization of the `fcontent` field in `fhtml` field types. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"0000-00-00"},{"id":"38cbcbc24886842fe9668811d3c102f2e13a542b","name":"Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/calculated-fields-form\/calculated-fields-form-5450-authenticated-contributor-stored-cross-site-scripting-via-form-settings","description":"The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5.0. This is due to insufficient capability checks on the form settings save handler and insufficient input sanitization of the `fcontent` field in `fhtml` field types. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-03-12"}],"impact":{"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}}]},"updated":"1785853663"}