What the vulnerability does
01Description
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Explanation of Vulnerability in Simple Terms
02Summary
Calculated Fields Form versions up to 1.2.40 contain an improper input validation flaw that allows high-privilege users to modify data across site boundaries. The vulnerability requires administrator access and high attack complexity, but can affect other components or users when exploited. Low confidentiality and integrity impact.
What an attacker can do
03Attacker Capabilities
Read or modify sensitive data across different parts of the site if they have admin access.
Potential impact on your site
04Site Impact
Admins with compromised credentials could alter form data or access information they shouldn't reach.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level privileges; high attack complexity suggests specific conditions must be met.
Key dates
06Disclosure timeline
January 11, 2024
CVE published
April 8, 2026
Record updated
