Calculated Fields Form: DOM-based Cross-Site Scripting (XSS)

Summary

The WordPress plugin Calculated Fields Form up to and including version 5.5.2.8 contains a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious scripts into pages that use the plugin, which can steal visitor data or hijack accounts. No login is required, but a victim must perform an action such as opening a crafted link or page.

Affected

• codepeople Calculated Fields Form (WordPress plugin) from n/a through 5.5.2.8

Fixed in

• Version 5.5.2.9 or later (per Patchstack and the CNA record; vendor changelog not independently verified)

Workaround

• No vendor-documented workaround.
• Patchstack has issued a mitigation rule that blocks attacks until the plugin is updated.
• Generic measures until the update is applied: disable the plugin on pages that do not need it, or filter requests with a web application firewall (WAF).

Exploitation

• OffSeq reports 'Not known to be exploited' with thin evidence; attack traffic may have been observed but this is not confirmed.
• Patchstack rates the issue as medium priority and expects exploitation.
• No public proof of concept found.
• Not listed in CISA KEV in the sources checked.

Our recommendation

• Update Calculated Fields Form to version 5.5.2.9 or later as soon as possible and confirm the installed version afterwards.
• If an update cannot be applied immediately, disable the plugin on pages that do not need it or apply WAF filtering.
• Check all WordPress sites for this plugin and for other outdated plugins.
• Monitor web server and WAF logs for suspicious requests and review forms for unexpected scripts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory for CVE-2026-124253 patchstack.com
• Patchstack vulnerabilities overview for Calculated Fields Form patchstack.com
• OffSeq Radar entry for CVE-2026-124253 radar.offseq.com
• WordPress.org plugin page for Calculated Fields Form wordpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 12:25.