Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via Nested Field References in Calculated Field Equations

ID

WPSEC-2026-0365

Plugin

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More (calculated-fields-form)

Affected

all versions before 5.5.1.6

Remediation

Update to 5.5.1.6 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22

Attack surface

Calculated Fields Form on WPSec AttackSurface

Fix released

2026-10-02

Published

2026-10-03

Description

The Calculated Fields Form plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting in all versions up to, and including, 5.5.1.5. When a calculated field's equation is evaluated in the browser, field references are replaced with the fields' current values and the equation is then re-scanned from the start, so a field reference contained inside an already inserted text value is replaced as well. The inserted value's quotes end the surrounding string literal, placing another field's value outside it in the equation that the plugin then evaluates as JavaScript. This makes it possible for unauthenticated attackers to execute arbitrary script in a victim's browser if they can trick the victim into opening a crafted link. Exploitation requires a public form whose equation uses a text field that takes its predefined value from a URL parameter ('url.<name>'), plus a second field in the same form that the attacker can also prefill from the URL. Fixed in 5.5.1.6, which substitutes each field reference only once.

References

• https://wpsec.com/vuln/WPSEC-2026-0365/
• https://plugins.svn.wordpress.org/calculated-fields-form/tags/5.5.1.6/
• https://wordpress.org/plugins/calculated-fields-form/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS