Calculated Fields Form CVE-2026-103909

Exploitation is NOT possible against default configurations. It requires all of the following on the target: (1) the plugin version ≤5.5.1.5 is installed; (2) a publicly accessible form is published; (3) an administrator has bound at least two fields to 'url.<name>' predefined values; and (4) those bound values are used together in a concatenation equation within the form's calculation logic. The attack is reflected and DOM-based, so it additionally requires victim user interaction (UI:R) - the target must click an attacker-supplied crafted link. The attacker needs no authentication (PR:N). The limiting factors are significant: the non-universal admin configuration dependency and the mandatory social-engineering/click step meaningfully narrow the exploitable population below the raw install base.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS 3.1 base score of 6.1 (MEDIUM) reflects reflected DOM-based XSS: network vector (AV:N) and no privileges (PR:N) raise reach, but user interaction (UI:R) and the limited confidentiality/integrity impact (C:L/I:L, A:N) cap severity, with S:C accounting for script execution in the victim's browser context. Crucially, no EPSS score, KEV entry, or public exploit was provided - exploitation status is therefore 'no public exploit identified at time of analysis,' and there is no evidence of active exploitation. The strongest real-world dampener is a configuration precondition the attacker does not control: the target site must host a publicly accessible form in which an administrator bound at least two 'url.<name>' predefined-value fields that are combined in a concatenation equation - described by the source as 'plausible but not universal.' This means the CVSS AC:L rating likely understates real difficulty, since a non-default prerequisite must already exist on the target (see assessed vector, where AC:H is more defensible). Net: treat as a routine-to-prioritized patch for sites running vulnerable versions with the at-risk form configuration, but it does not warrant emergency response absent exploitation signals. No signals are in direct conflict; the main caveat is that EPSS/KEV/POC data is simply absent rather than contradictory.

An attacker identifies a public-facing page running Calculated Fields Form where an admin has configured two or more fields using 'url.<name>' predefined values concatenated in an equation. The attacker crafts a malicious URL embedding a script payload in one of those bound 'url.<name>' parameters and lures a victim (e.g., a logged-in admin) into clicking it, causing the unsanitized value to be reflected into the DOM and executed in the victim's browser. No public proof-of-concept was provided in the input; feasibility is inferred from the CVSS vector (AV:N/UI:R) and the referenced source lines.