CVE-2024-0963

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
5.4MEDIUM
EPSS
0.2%
top 55.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Codepeople Calculated Fields Form
Timeline
PublishedFeb 2
Latest updateApr 11

Description

The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping on user supplied 'location' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NExploitability: 3.1 | Impact: 2.7

Affected Packages2 packages

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

3
VulDB
Calculated Fields Form Plugin up to 1.2.52 on WordPress cross site scripting (ID 3029782)↗2026-04-11
▶
CVEList
Calculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting↗2024-02-02
▶
GHSA
GHSA-ph96-9c75-4297: The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all ve↗2024-02-02
▶