CVE-2026-100184 in Calculated Fields Form Plugin
Summary
by MITRE • 10/01/2026
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x (attacker-chosen name matching the form's url.<name> predefined value)' parameter in all versions up to, and including, 5.5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the targeted form has a Text Area field configured with a 'url.<name>' Predefined Value and predefinedClick disabled, which is a documented and commonly used plugin feature.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The Calculated Fields Form plugin for WordPress contains a critical security flaw classified as a Reflected DOM-Based Cross-Site Scripting vulnerability in versions up to 5.5.1.3. This weakness stems from insufficient input sanitization and output escaping mechanisms within the application code, specifically affecting parameters derived from user-controlled inputs that are reflected back into the page context without proper validation. The primary vector for this exploitation is the x parameter, which corresponds to an attacker-chosen name matching a predefined value structure associated with form fields. When a victim interacts with a maliciously crafted link or input trigger, the unsanitized data is processed by the browser's Document Object Model, leading to the execution of arbitrary JavaScript code within the context of the vulnerable website. This aligns closely with CWE-79, which defines Improper Neutralization of Input During Web Page Generation as Commonly Known as Cross-Site Scripting, highlighting the failure to neutralize special characters that could be interpreted as executable commands by the browser engine.
The operational impact of this vulnerability is significant because it allows unauthenticated attackers to inject malicious scripts into pages viewed by legitimate users. The exploitation scenario typically involves tricking a user into performing an action such as clicking on a specially constructed URL or submitting a form field where the attacker has injected script payloads. Once executed, these scripts can perform various malicious activities including session hijacking, credential theft via keylogging, defacement of the website content, or redirecting users to phishing sites. The severity is compounded by the fact that this vulnerability does not require authentication, making it accessible to any internet user who discovers a vulnerable instance. Furthermore, the attack relies on social engineering tactics to induce victim interaction, which remains one of the most effective methods for bypassing automated security controls and achieving successful exploitation in real-world scenarios as described in MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically under JavaScript execution contexts within web browsers.
A critical prerequisite for exploiting this vulnerability is that the targeted WordPress site must have a specific configuration enabled: a Text Area field configured with a url.<name> Predefined Value while having predefinedClick disabled. This feature is documented in the plugin's official documentation and is commonly used by developers to automate form population based on URL parameters, making it a prevalent setup rather than an edge case. Because this functionality is widely adopted, the attack surface for this vulnerability is extensive across the WordPress ecosystem. The combination of common configuration practices with insufficient sanitization creates a high-probability exploitation path for attackers targeting sites using Calculated Fields Form. This highlights the importance of reviewing default configurations and ensuring that dynamic content injection points are strictly validated against expected input patterns to prevent script insertion.
To mitigate this vulnerability, site administrators should immediately update the Calculated Fields Form plugin to version 5.5.1.4 or later where these sanitization issues have been addressed by the developers. Until an update is applied, temporary mitigations include disabling the specific form field configuration that utilizes url.<name> predefined values if such functionality is not strictly required for business operations. Additionally, implementing a Web Application Firewall can help detect and block requests containing known XSS payloads targeting this parameter, although WAFs should be viewed as a compensating control rather than a primary fix. Developers integrating similar forms in custom WordPress themes or plugins must ensure that all user-supplied data is properly escaped using functions like esc_html or wp_kses_post before being output to the browser DOM. Regular security audits and adherence to OWASP guidelines for input validation are essential practices to prevent recurrence of such flaws in web applications built on PHP frameworks.