Calculated Fields Form Ai Form Builder For Wordpress Contact Payment Quote Quiz More
Monthly
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.5) lets unauthenticated attackers inject arbitrary script into a page via the plugin's url.<name> predefined field values, with the payload executing in the victim's browser once the victim clicks an attacker-supplied crafted link. Exploitation is not possible on default installs: the site must publish a publicly reachable form in which an administrator has bound at least two fields to url.<name> predefined values and used those values together in a concatenation equation, so a successful attack depends on a specific non-universal admin configuration plus victim user interaction. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, and the independently assessed vector (AC:H, UI:R, scope changed) places this in the moderate-priority range rather than an emergency.
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.3) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted link, provided the targeted form contains a Text Area field configured with a 'url.<name>' Predefined Value and predefinedClick disabled - a documented, commonly used but per-form configuration the attacker does not control. With a CVSS of 4.7 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), the practical risk against arbitrary installs is limited by that configuration prerequisite and the required user interaction, and the impact is scoped to the victim's session rather than the server. No public exploit code was identified at time of analysis and the vulnerability is not listed in CISA KEV.
Reflected DOM-based cross-site scripting in the CodePeople Calculated Fields Form plugin for WordPress (all versions up to and including 5.5.1.3) allows unauthenticated attackers to execute arbitrary script in a victim's browser, but only on sites that have been specifically configured to expose the flaw. The issue is conditional rather than a default-configuration defect: the site must host a public form with a Select2-enabled dropdown whose choices are built by a calculated equation that pipes a URL parameter through GETURLPARAMETER() into setChoices({texts:[...]}); where that wiring exists, a single crafted link is enough to trigger script execution when a user clicks it. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation; the assessed severity is moderate (CVSS 6.1), with impact confined to the victim's session (C:L/I:L/A:N) and victim interaction required (UI:R).
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.5) lets unauthenticated attackers inject arbitrary script into a page via the plugin's url.<name> predefined field values, with the payload executing in the victim's browser once the victim clicks an attacker-supplied crafted link. Exploitation is not possible on default installs: the site must publish a publicly reachable form in which an administrator has bound at least two fields to url.<name> predefined values and used those values together in a concatenation equation, so a successful attack depends on a specific non-universal admin configuration plus victim user interaction. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, and the independently assessed vector (AC:H, UI:R, scope changed) places this in the moderate-priority range rather than an emergency.
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.3) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted link, provided the targeted form contains a Text Area field configured with a 'url.<name>' Predefined Value and predefinedClick disabled - a documented, commonly used but per-form configuration the attacker does not control. With a CVSS of 4.7 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), the practical risk against arbitrary installs is limited by that configuration prerequisite and the required user interaction, and the impact is scoped to the victim's session rather than the server. No public exploit code was identified at time of analysis and the vulnerability is not listed in CISA KEV.
Reflected DOM-based cross-site scripting in the CodePeople Calculated Fields Form plugin for WordPress (all versions up to and including 5.5.1.3) allows unauthenticated attackers to execute arbitrary script in a victim's browser, but only on sites that have been specifically configured to expose the flaw. The issue is conditional rather than a default-configuration defect: the site must host a public form with a Select2-enabled dropdown whose choices are built by a calculated equation that pipes a URL parameter through GETURLPARAMETER() into setChoices({texts:[...]}); where that wiring exists, a single crafted link is enough to trigger script execution when a user clicks it. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation; the assessed severity is moderate (CVSS 6.1), with impact confined to the victim's session (C:L/I:L/A:N) and victim interaction required (UI:R).