Calculated Fields Form CVE-2026-100179

Exploitation is NOT possible against default/stock configurations. It requires the target site to host a publicly accessible Calculated Fields Form that has a Select2-enabled dropdown whose choices are dynamically populated by a calculated equation that pipes a URL parameter through the GETURLPARAMETER() function into setChoices({texts:[...]}). Only when that specific equation/dropdown wiring exists is the reflected URL-parameter value rendered unsanitized. Limiting factors: the attack is unauthenticated (PR:N) but requires victim user interaction (UI:R, clicking a crafted link), impact is confined to script execution in the victim's browser (C:L/I:L, no availability impact), and the required dropdown-from-URL-parameter configuration is author-created and non-default, substantially narrowing the exploitable site population despite the low attacker-side complexity.

This is a genuine but conditional, moderate-severity issue rather than a top-tier priority. The CVSS 3.1 vector (6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) describes a network-reachable, unauthenticated reflected DOM-based XSS that nonetheless requires victim interaction (UI:R) and yields only limited confidentiality/integrity impact scoped to the browser context (C:L/I:L, S:C). No EPSS score, CISA KEV listing, or public proof-of-concept is present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation and should not be treated as such. The most important mitigating signal is not in the raw CVSS metrics but in the description: exploitation is gated on a specific, non-default form configuration (a public form with a Select2 dropdown whose choices are fed from a URL parameter via GETURLPARAMETER() into setChoices). Although PR:N/AC:L make the attacker's side trivial, the realistic population of exploitable sites is limited to those that happen to have built this exact equation-driven dropdown. No signals conflict here; the CVSS vector is internally consistent with the description. Net: patch on a normal cadence, prioritizing sites known to use calculated-equation-populated dropdowns.

An attacker identifies a target WordPress site running Calculated Fields Form (≤5.5.1.3) with a public form whose Select2 dropdown choices are populated by a calculated equation piping a URL parameter through GETURLPARAMETER(). The attacker crafts a link to that form page embedding a malicious script in the consumed URL parameter and lures a logged-in user or visitor into clicking it; the unsanitized value is reflected into setChoices({texts:[...]}) and executed in the victim's browser. No public proof-of-concept is identified in the provided data, and success requires only the single crafted link once the vulnerable configuration exists.