Calculated Fields Form vulnerabilities

The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to Reflected DOM-Based XSS via the 'x' parameter (any URL parameter consumed by the form's calculated equation). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user clicks a crafted link. Exploitation requires a public form with a Select2 dropdown populated via a calculated equation using GETURLPARAMETER() and setChoices().

The Calculated Fields Form plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary' parameter in all versions up to, and including, 5.5.1.5. An unauthenticated attacker can inject arbitrary web scripts if they can trick a user into clicking a link.

The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to Reflected DOM-Based XSS via the 'x' parameter (attacker-chosen name matching the form's url.<name> predefined value). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user clicks a crafted link. Exploitation requires a Text Area field with 'url.<name>' Predefined Value and predefinedClick disabled.

The Calculated Fields Form plugin in versions up to and including 5.5.1.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.