CVE-2026-95529
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Calculated Fields Form plugin in versions up to and including 5.5.1.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.
Risk Assessment
An attacker could execute arbitrary JavaScript in a victim's browser, potentially leading to session theft, redirects, or content modification.
Recommendation
Update the Calculated Fields Form plugin to a version newer than 5.5.1.1.
Other vulnerabilities in Calculated Fields Form
See all- CVE-2026-100184Medium
The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to Reflected DOM-Based XSS via the 'x' parameter (attacker-chosen name matching the form's url.<name> predefined value). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user clicks a crafted link. Exploitation requires a Text Area field with 'url.<name>' Predefined Value and predefinedClick disabled.
- CVE-2026-100179Medium
The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to Reflected DOM-Based XSS via the 'x' parameter (any URL parameter consumed by the form's calculated equation). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user clicks a crafted link. Exploitation requires a public form with a Select2 dropdown populated via a calculated equation using GETURLPARAMETER() and setChoices().
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS