HomeWordPress vulnerabilitiesCalculated Fields Form
Calculated Fields Form vulnerabilities
Calculated Fields Form has 14 known vulnerabilities in this database. The most recent published record is dated 3 Oct 2026.
- Known vulnerabilities
- 14
- Active installs
- 40,000+
- Latest version
- 5.5.1.5
- Last updated
- 29 Sep 2026
- Most recent
- 3 Oct 2026
No fixed version has been published yet, so consider disabling, removing or replacing the plugin until a safe release is available.
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Cross-site scripting (XSS) CVE-2026-103909 | Medium 6.1 | Up to 5.5.1.5 | No fixed version yet | 4 d ago |
| Cross-site scripting (XSS) CVE-2026-100184 | Medium 4.7 | Up to 5.5.1.3 | Fixed in a later version (latest 5.5.1.5) | 6 d ago |
| Cross-site scripting (XSS) CVE-2026-100179 | Medium 6.1 | Up to 5.5.1.3 | Fixed in a later version (latest 5.5.1.5) | 6 d ago |
| Cross-site scripting (XSS) CVE-2026-3986 | Medium 6.4 | Up to 5.4.5.0 | Fixed in a later version (latest 5.5.1.5) | 13 Mar 2026 |
| Cross-site scripting (XSS) CVE-2024-13382 | Medium 4.8 | Up to 5.2.64 | Fixed in a later version (latest 5.5.1.5) | 15 May 2025 |
| Cross-site scripting (XSS) CVE-2024-13381 | Medium 4.8 | Before 5.2.62 | Fixed in 5.2.62 | 1 May 2025 |
| Cross-site scripting (XSS) CVE-2024-12273 | Low 3.5 | Before 5.2.62 | Fixed in 5.2.62 | 29 Apr 2025 |
| Denial of service CVE-2024-12601 | Medium 5.3 | Before 5.2.64 | Fixed in 5.2.64 | 17 Dec 2024 |
| Content injection CVE-2024-9940 | Medium 5.3 | Before 5.2.46 | Fixed in 5.2.46 | 17 Oct 2024 |
| Cross-site scripting (XSS) CVE-2024-2020 | High 7.2 | Before 5.1.57 | Fixed in 5.1.57 | 13 Mar 2024 |
| Cross-site scripting (XSS) CVE-2024-0963 | Medium 6.4 | Up to 1.2.52 | Fixed in a later version (latest 5.5.1.5) | 2 Feb 2024 |
| Cross-site scripting (XSS) CVE-2023-0389 | Medium 4.8 | Before 1.1.151 | Fixed in 1.1.151 | 16 Jan 2024 |
| Cross-site scripting (XSS) CVE-2023-6446 | Medium 4.4 | Up to 1.2.40 | Fixed in a later version (latest 5.5.1.5) | 11 Jan 2024 |
| Cross-site scripting (XSS) CVE-2020-7228 | Medium 5.4 | Up to 1.0.353 | Fixed in a later version (latest 5.5.1.5) | 22 Jan 2020 |
Read the published descriptions
- CVE-2026-103909, 3 Oct 2026
- The Calculated Fields Form - AI Form Builder for WordPress - Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary (whichever names the admin bound via url.<name>)' parameter in all versions up to, and including, 5.5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted site to host a publicly accessible form in which an administrator has configured at least two fields with url.<name> predefined values that are used together in a concatenation equation - a plausible but not universal configuration. CVE record
- CVE-2026-100184, 1 Oct 2026
- The Calculated Fields Form - AI Form Builder for WordPress - Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x (attacker-chosen name matching the form's url.<name> predefined value)' parameter in all versions up to, and including, 5.5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the targeted form has a Text Area field configured with a 'url.<name>' Predefined Value and predefinedClick disabled, which is a documented and commonly used plugin feature. CVE record
- CVE-2026-100179, 1 Oct 2026
- The Calculated Fields Form - AI Form Builder for WordPress - Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x (any URL parameter consumed by the form's calculated equation)' parameter in all versions up to, and including, 5.5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the target site to have a public form configured with a Select2-enabled dropdown whose choices are populated via a calculated equation that pipes a URL parameter through GETURLPARAMETER() into setChoices({texts:[...]}); given that configuration, exploitation requires only a single crafted link. CVE record
- CVE-2026-3986, 13 Mar 2026
- The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5.0. This is due to insufficient capability checks on the form settings save handler and insufficient input sanitization of the `fcontent` field in `fhtml` field types. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-13382, 15 May 2025
- The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVE record
- CVE-2024-13381, 1 May 2025
- The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVE record
- CVE-2024-12273, 29 Apr 2025
- The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). CVE record
- CVE-2024-12601, 17 Dec 2024
- The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited height and width parameters for CAPTCHA images. This makes it possible for unauthenticated attackers to send multiple requests with large values, resulting in slowing server resources if the server does not mitigate Denial of Service attacks. CVE record
- CVE-2024-9940, 17 Oct 2024
- The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not properly neutralizing HTML elements from submitted forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views form submissions in their email. CVE record
- CVE-2024-2020, 13 Mar 2024
- The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and including, 5.1.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the professional version or higher. CVE record
- CVE-2024-0963, 2 Feb 2024
- The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping on user supplied 'location' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2023-0389, 16 Jan 2024
- The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) CVE record
- CVE-2023-6446, 11 Jan 2024
- The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. CVE record
- CVE-2020-7228, 22 Jan 2020
- The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user. CVE record
What to do if you run Calculated Fields Form
If you run Calculated Fields Form, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Calculated Fields Form vulnerabilities
Free. We email you when a new vulnerability is published for Calculated Fields Form, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.