CVE-2026-103909 in Calculated Fields Form Plugin
Summary
by MITRE • 10/03/2026
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary (whichever names the admin bound via url.<name>)' parameter in all versions up to, and including, 5.5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted site to host a publicly accessible form in which an administrator has configured at least two fields with url.<name> predefined values that are used together in a concatenation equation — a plausible but not universal configuration.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/03/2026
The Calculated Fields Form plugin for WordPress, specifically versions up through 5.5.1.5, contains a critical security flaw classified as a Reflected DOM-Based Cross-Site Scripting vulnerability. This weakness stems from insufficient input sanitization and output escaping mechanisms within the plugin's handling of dynamic form parameters. The specific point of failure involves an arbitrary parameter that allows administrators to bind values via URL query strings using a predefined naming convention, typically formatted as url.<name>. When these parameters are processed by the client-side JavaScript engine without proper validation or encoding, they become vectors for injecting malicious scripts into the web page context.
The technical nature of this vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector is reflected rather than stored, meaning the malicious payload is embedded within a URL and executed immediately upon rendering by the victim's browser. This type of DOM-based XSS often falls under MITRE ATT&CK technique T1059.007, specifically Command and Scripting Interpreter via JavaScript. Because the execution occurs in the client-side environment, it bypasses many server-side security controls that might otherwise filter or block malicious content before it reaches the database or final HTML output.
Exploitation of this vulnerability requires a specific configuration state within the target WordPress site to be successful. The targeted form must have at least two fields configured with predefined values derived from URL parameters, which are then used together in a concatenation equation on the frontend. While this is a plausible and not uncommon setup for complex calculation forms, it is not universal across all installations of the plugin. An unauthenticated attacker can exploit this by crafting a malicious link that includes the injected script within one of these bound parameter fields. When a victim clicks this link, their browser parses the URL, extracts the unsanitized input, and executes the embedded JavaScript code as part of the page's DOM structure.
The operational impact of a successful exploitation is severe, potentially leading to complete compromise of user sessions or sensitive data exposure within the context of the vulnerable site. Attackers can steal session cookies, perform actions on behalf of authenticated users, deface websites, or redirect victims to phishing sites designed to harvest credentials. Since the attack relies on social engineering tactics such as tricking a user into clicking a malicious link, it poses a significant risk in environments where forms are shared via email, messaging platforms, or public forums. The lack of authentication required for exploitation further lowers the barrier to entry for attackers, making this vulnerability attractive for automated scanning and widespread attacks against sites running affected versions.
Mitigation strategies should prioritize immediate remediation by updating the Calculated Fields Form plugin to a version later than 5.5.1.5 where these sanitization issues have been addressed. In cases where an update is not immediately feasible, administrators can implement temporary workarounds such as disabling public access to forms that utilize URL-bound parameters or restricting form usage to authenticated users only if the application architecture permits. Additionally, deploying a Web Application Firewall with rules tuned to detect and block reflected XSS payloads in query strings can provide an additional layer of defense against exploitation attempts while longer-term fixes are implemented. Regular security audits and code reviews focusing on input validation and output encoding practices are essential for preventing similar vulnerabilities in future development cycles.