Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

13 records

Vendor: codepeople Component: Calculated Fields Form Clear all filters
TI-2024-12424 CVE-2024-13382 · GHSA-q3cq-6xv8-j4p3

Calculated Fields Form < 5.2.64 - Admin+ Stored XSS

Priority MEDIUM 55

The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when t…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00326 Published 2025-05-15 Fixed in 5.2.64 CWE-79
TI-2024-12423 CVE-2024-13381 · GHSA-5gp3-3rvx-qhx2

Calculated Fields Form < 5.2.62 - Admin+ Stored XSS

Priority MEDIUM 55

The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when t…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00272 Published 2025-05-01 Fixed in 5.2.62 CWE-79
TI-2024-11384 CVE-2024-12273 · GHSA-65vr-4gg3-qw3m

Calculated Fields Form < 5.2.62 - Admin+ Stored XSS

Priority MEDIUM 50

The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when t…

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00272 Published 2025-04-29 Fixed in 5.2.62 CWE-79
TI-2024-11693 CVE-2024-12601 · GHSA-vc5q-pj76-5g6f

Calculated Fields Form <= 5.2.63 - Denial of Service

Priority LOW 31

The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00578 Published 2024-12-17 No fix listed CWE-400
TI-2024-09224 CVE-2024-9940 · GHSA-c8q2-82x8-w4xj

Calculated Fields Form <= 5.2.45 - HTML Injection

Priority LOW 30

The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00396 Published 2024-10-17 No fix listed CWE-75
TI-2024-19535 CVE-2024-29759 · GHSA-9qq5-g8qh-67pf

WordPress Calculated Fields Form plugin <= 1.2.54 - Reflected Cross Site Scripting (XSS) vulnerability

Priority LOW 32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Calculated Fields Form allows Reflected XSS.This issue affects Calculated Fields Form: from n/a through 1.2…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00421 Published 2024-03-27 No fix listed CWE-79
TI-2024-00888 CVE-2024-0963 · GHSA-ph96-9c75-4297

Calculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 29

The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up to, and including, 1.2.52 due to insufficient input sanitiza…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00476 Published 2024-02-02 No fix listed CWE-79
TI-2023-00372 CVE-2023-0389 · GHSA-r34p-xvw4-c7qj

Calculated Fields Form < 1.1.151 - Admin+ Stored Cross-Site Scripting via Dropdown Fields

Priority MEDIUM 55

The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00473 Published 2024-01-16 Fixed in 1.1.151 CWE-79