Calculated Fields Form CVE-2026-100184

Exploitation requires that the targeted form has a Text Area field configured with a 'url.<name>' Predefined Value AND with predefinedClick disabled - a documented, commonly-used plugin feature but a per-form configuration the attacker does not control (this drives AC:H). The attacker must also social-engineer the victim into clicking a crafted link or performing an action (UI:R), and the payload only executes in that victim's browser. No authentication is needed (PR:N), and the vector is network-delivered, but the dependence on a specific non-universal form configuration plus required victim interaction materially limits real-world exploitability against arbitrary installs.

This is a genuine-but-low-priority issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N = 4.7, Medium) tells a consistent story with the description: a reflected DOM-based XSS that is network-reachable and unauthenticated (PR:N) but gated by high attack complexity (AC:H) and required victim interaction (UI:R). The AC:H is well-justified because exploitation is not universal - it only works against forms whose Text Area field is configured with a 'url.<name>' Predefined Value and predefinedClick disabled, so the attacker depends on a specific per-form configuration they do not control. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis and no confirmed active exploitation. The scope change (S:C) and C:L/I:L reflect limited browser-context impact (session/DOM manipulation, limited data theft) rather than server compromise. Net: a real, patch-worthy reflected XSS in a widely installed plugin, but the complexity gate, victim-interaction requirement, and absence of exploitation signals place it well below actively-exploited or wormable classes. No conflicting signals were found between the CVSS vector and the description.

An attacker identifies a site running Calculated Fields Form with a vulnerable Text Area field (url.<name> Predefined Value, predefinedClick disabled), crafts a URL containing a malicious value for the attacker-chosen parameter matching that predefined value, and sends it to a victim via phishing or a malicious link. When the victim clicks and loads the page, the unsanitized value is reflected into the DOM and executes attacker script in the victim's browser session. No public exploit code was provided, and success depends on the specific form configuration plus the victim taking the action.