Calculated Fields Form <= 5.5.2.8 - Unauthenticated DOM-Based Cross-Site Scripting via URL Parameters
- ID
- WPSEC-2026-2732
- Plugin
- Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More (calculated-fields-form)
- Affected
- from 5.4.0.6 before 5.5.2.9
- Remediation
- Update to 5.5.2.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-08
- Attack surface
- Calculated Fields Form on WPSec AttackSurface
- Fix released
- Published
Description
The Calculated Fields Form plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via field default values taken from URL parameters (the 'url.<name>' predefined value) in versions 5.4.0.6 up to, and including, 5.5.2.8. When the browser blocks eval(), for example because of a Content Security Policy without 'unsafe-eval', the plugin evaluates calculated field equations by building a '<script>' tag as an HTML string and appending it with jQuery. Field values inserted into the equation were only escaped for JavaScript string context, and values accessed as raw values were not sanitized at all, so a value containing '</script>' could close the script element and inject arbitrary HTML and script. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in the context of a victim's browser if they can trick the victim into clicking a crafted link to a page containing a form whose equations use such a field, on sites where eval() is blocked.
References
- https://wpsec.com/vuln/WPSEC-2026-2732/
- https://plugins.svn.wordpress.org/calculated-fields-form/tags/5.5.2.9/
- https://wordpress.org/plugins/calculated-fields-form/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS