{"id":"CVE-2026-124253","kind":"vulnerability","aliases":["CVE-2026-124253"],"related":[],"title":"Calculated Fields Form WordPress plugin: DOM-based XSS through version 5.5.2.8","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Calculated Fields Form calculated-fields-form allows DOM-Based XSS.This issue affects Calculated Fields Form: from n/a through 5.5.2.8.","summary":"DOM-based XSS in the Calculated Fields Form WordPress plugin (codepeople) through 5.5.2.8, exploitable by an unauthenticated attacker when a victim is tricked into interacting (e.g. a crafted link). Fixed in 5.5.2.9. No exploitation or public PoC known.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"calculated-fields-form","fixed":["5.5.2.9"],"affected":"<= 5.5.2.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["calculated-fields-form","codepeople","package","unauthenticated","wordpress","xss"],"not_affected_if":["plugin-not-installed","version-5.5.2.9-or-later"],"how_to_check":"In WordPress admin > Plugins, or run: wp plugin get calculated-fields-form --field=version. Versions <= 5.5.2.8 are vulnerable; 5.5.2.9 is patched. Only matters if the plugin is installed and active.","fix":"Update the Calculated Fields Form plugin to 5.5.2.9 or later (per Patchstack; vendor changelog not read).","status":"open","published_at":"2026-11-11T11:17:16+00:00","first_seen_at":"2026-11-11T11:26:56+00:00","triaged_at":"2026-11-11T11:27:32+00:00","updated_at":"2026-11-11T11:28:01+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T11:27:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Calculated Fields Form WordPress plugin: DOM-based XSS through version 5.5.2.8","impact":"medium","summary":"The Calculated Fields Form plugin for WordPress, made by codepeople, has a DOM-based cross-site scripting flaw in versions up to and including 5.5.2.8. An attacker can get script to run in a visitor's browser, which can steal session data or act as the user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","calculated-fields-form","codepeople"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in visitors' browsers on the affected site","analyst_note":"Confirm the fixed version and the triggering conditions from the NVD entry or the vendor's WordPress plugin page; the sources give only the range through 5.5.2.8.","how_to_check":"- Check the installed version of the `calculated-fields-form` plugin in the WordPress admin under Plugins.\n- Compare it against `5.5.2.8`; versions at or below that are in the reported range.","plain_action":"","product_name":"calculated-fields-form","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Calculated Fields Form WordPress plugin at version 5.5.2.8 or earlier are in the reported range. The sources do not say which plugin settings or form configurations are required to trigger the flaw, so the exposure of any given site is unknown.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000753,"input_tokens":4556,"output_tokens":594,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the triggering conditions from the NVD entry or the vendor's WordPress plugin page; the sources give only the range through 5.5.2.8.","search":"'-124253':15A,18A '-2026':14A,17A '5.5.2.8':12A,45B,106C '5.5.2.9':64B 'affect':99C 'allow':93C 'attack':50B 'base':8A,34B,96C 'calcul':1A,24B,38B,86C,90C,100C 'calculated':20A 'calculated-fields-form':19A,23B,89C 'codepeopl':27B,43B,85C 'craft':60B 'cross':80C 'cross-sit':79C 'cve':13A,16A 'dom':7A,33B,95C 'dom-bas':6A,32B,94C 'e.g':58B 'exploit':46B,66B 'field':2A,25B,39B,87C,91C,101C 'fields':21A 'fix':62B 'form':3A,22A,26B,40B,88C,92C,102C 'generat':78C 'improp':71C 'input':74C 'interact':57B 'issu':98C 'known':70B 'link':61B 'n/a':104C 'neutral':72C 'packag':28B 'page':77C 'plugin':5A,42B 'poc':69B 'public':68B 'script':82C 'site':81C 'trick':55B 'unauthent':29B,49B 'version':11A 'victim':53B 'vulner':83C 'web':76C 'wordpress':4A,30B,41B 'xss':9A,31B,35B 'xss.this':97C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running Calculated Fields Form (about 40,000+ installs) at 5.5.2.8 or earlier. Patchstack says the attacker needs no account but a user must click a crafted link or visit a crafted page. Sites without the plugin, or on 5.5.2.9+, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["calculatedfieldsform"],"ptokens":["calculated","fields","form"],"labels":["calculatedfieldsform","codepeople","high","package","unauthenticated","vendor","wordpress","xss"],"campaign_type":null,"search_a":"'-124253':15A,18A '-2026':14A,17A '5.5.2.8':12A 'base':8A 'calcul':1A 'calculated':20A 'calculated-fields-form':19A 'cve':13A,16A 'dom':7A 'dom-bas':6A 'field':2A 'fields':21A 'form':3A,22A 'plugin':5A 'version':11A 'wordpress':4A 'xss':9A","search_b":"'5.5.2.8':45B '5.5.2.9':64B 'attack':50B 'base':34B 'calcul':24B,38B 'calculated-fields-form':23B 'codepeopl':27B,43B 'craft':60B 'dom':33B 'dom-bas':32B 'e.g':58B 'exploit':46B,66B 'field':25B,39B 'fix':62B 'form':26B,40B 'interact':57B 'known':70B 'link':61B 'packag':28B 'plugin':42B 'poc':69B 'public':68B 'trick':55B 'unauthent':29B,49B 'victim':53B 'wordpress':30B,41B 'xss':31B,35B","search_c":"'5.5.2.8':106C 'affect':99C 'allow':93C 'base':96C 'calcul':86C,90C,100C 'calculated-fields-form':89C 'codepeopl':85C 'cross':80C 'cross-sit':79C 'dom':95C 'dom-bas':94C 'field':87C,91C,101C 'form':88C,92C,102C 'generat':78C 'improp':71C 'input':74C 'issu':98C 'n/a':104C 'neutral':72C 'page':77C 'script':82C 'site':81C 'vulner':83C 'web':76C 'xss.this':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T11:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124253","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124253","severity":null,"published_at":"2026-11-11T11:17:16+00:00","modified_at":"2026-11-11T11:17:16+00:00","first_seen_at":"2026-11-11T11:26:56+00:00","fetched_at":"2026-11-11T11:26:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124253:3541","url":"https://patchstack.com/database/wordpress/plugin/calculated-fields-form/vulnerability/wordpress-calculated-fields-form-plugin-5-5-2-8-cross-site-scripting-xss-vulnerability","severity":null,"published_at":"2026-11-11T11:28:01+00:00","modified_at":"2026-11-11T11:28:01+00:00","first_seen_at":"2026-11-11T11:28:01+00:00","fetched_at":"2026-11-11T11:28:01+00:00","note":"Patchstack (reporter/CNA) lists <=5.5.2.8 vulnerable, 5.5.2.9 patched, unauthenticated, user interaction required. Vendor changelog not readable, so nothing marked verified.","cites":["https://patchstack.com/database/wordpress/plugin/calculated-fields-form/vulnerability/wordpress-calculated-fields-form-plugin-5-5-2-8-cross-site-scripting-xss-vulnerability","https://wordpress.org/plugins/calculated-fields-form/"]}],"documents":[{"id":125065,"url":"https://patchstack.com/database/wordpress/plugin/calculated-fields-form/vulnerability/wordpress-calculated-fields-form-plugin-5-5-2-8-cross-site-scripting-xss-vulnerability","title":"Patchstack: Calculated Fields Form <= 5.5.2.8 XSS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":125066,"url":"https://wordpress.org/plugins/calculated-fields-form/","title":"Calculated Fields Form plugin page (WordPress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}