Calculated Fields Form CVE-2026-95529

Requires the WordPress 'Calculated Fields Form' plugin (vendor codepeople) at version <= 5.5.1.1 to be installed and active. Exploitation is unauthenticated (PR:N) and remote (AV:N) but is LIMITED by required user interaction (UI:R): a victim must click an attacker-crafted link or load an attacker-controlled page that triggers the reflected unsanitized input. Impact is confined to client-side script execution in the site's origin; no server-side code execution or authentication bypass is implied. Higher-value impact depends on a privileged victim (e.g., an authenticated admin) being lured into triggering the payload.

This is a HIGH-CVSS-but-moderate-real-risk issue. The CVSS 3.1 base score of 7.1 is inflated by the CVSS vector's scope-change (S:C) and the assignment of low impact to all three of C:L/I:L/A:L, a scoring pattern Patchstack routinely applies to reflected XSS. In practice this is client-side script execution constrained by UI:R (the victim must click an attacker-crafted link or visit a malicious page). No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or automated exploitation - exploitation status is 'no public exploit identified at time of analysis.' The vector's PR:N is credible (the description explicitly says 'Unauthenticated'), but the description does not distinguish reflected vs. stored XSS; the presence of UI:R strongly implies reflected. I assess A:L as generous - XSS rarely impacts availability - so a truer score is closer to 6.1 (A:N). Net: a real but not urgent priority, meaningful mainly on high-traffic sites where an attacker can lure logged-in users or admins.

An attacker crafts a URL or web page containing a malicious payload that is reflected unsanitized by the Calculated Fields Form plugin and sends it to a victim who visits a WordPress site running version <= 5.5.1.1. When the victim's browser renders the reflected input, attacker-controlled JavaScript executes in the site's origin, enabling session/cookie theft or actions performed as the victim. No public exploit code is identified at time of analysis, and exploitation requires the victim to interact (UI:R).