{
 "id": "WPSEC-2026-2732",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2732/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2732/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2732/index.md",
 "title": "Calculated Fields Form <= 5.5.2.8 - Unauthenticated DOM-Based Cross-Site Scripting via URL Parameters",
 "description": "The Calculated Fields Form plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via field default values taken from URL parameters (the 'url.<name>' predefined value) in versions 5.4.0.6 up to, and including, 5.5.2.8. When the browser blocks eval(), for example because of a Content Security Policy without 'unsafe-eval', the plugin evaluates calculated field equations by building a '<script>' tag as an HTML string and appending it with jQuery. Field values inserted into the equation were only escaped for JavaScript string context, and values accessed as raw values were not sanitized at all, so a value containing '</script>' could close the script element and inject arbitrary HTML and script. This makes it possible for unauthenticated attackers to execute arbitrary web scripts in the context of a victim's browser if they can trick the victim into clicking a crafted link to a page containing a form whose equations use such a field, on sites where eval() is blocked.",
 "plugin": {
  "slug": "calculated-fields-form",
  "name": "Calculated Fields Form",
  "full_name": "Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More",
  "wordpress_org": "https://wordpress.org/plugins/calculated-fields-form/",
  "advisories_url": "https://wpsec.com/vuln/plugin/calculated-fields-form/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/calculated-fields-form"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "5.4.0.6",
    "from_inclusive": true,
    "to": "5.5.2.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 5.4.0.6 before 5.5.2.9"
  ]
 },
 "introduced_in": "5.4.0.6",
 "fixed_in": "5.5.2.9",
 "remediation": "Update to 5.5.2.9 or later.",
 "fix_released": "2026-11-07T00:33:08+00:00",
 "published": "2026-11-08T00:40:42+00:00",
 "updated": "2026-11-07T11:06:40.630771+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2732/",
  "https://plugins.svn.wordpress.org/calculated-fields-form/tags/5.5.2.9/",
  "https://wordpress.org/plugins/calculated-fields-form/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/calculated-fields-form",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-08"
 }
}