Cpe:2.3:a:codepeople:calculated_fields_form:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3acodepeoplecalculated_fields_form/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 16:07:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCalculated Fields Form: DOM-based cross-site scripting (CVE-2026-124253)https://feed.craftedsignal.io/briefs/2026-11-calculated-fields-form-xss-cve-2026-124253/Wed, 11 Nov 2026 16:07:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-calculated-fields-form-xss-cve-2026-124253/The Calculated Fields Form plugin is vulnerable to DOM-Based Cross-site Scripting (XSS) due to improper neutralization of input during web page generation.The Calculated Fields Form plugin for WordPress, developed by codepeople, is affected by a DOM-based cross-site scripting (XSS) vulnerability, identified as CVE-2026-124253. This issue occurs due to improper neutralization of input during web page generation.

Impact

The vulnerability allows for DOM-Based XSS within the affected plugin versions ranging from n/a through 5.5.2.8.

Recommendation

Users of the Calculated Fields Form plugin should monitor the vendor for updates addressing this vulnerability.

]]>highadvisory