Vulnerability · Published Oct 17, 2024 · Assigned by Wordfence
CVE-2024-9940Calculated Fields Form <= 5.2.45 - HTML Injection
Medium 5.3
In plain English
A medium-severity security flaw in Calculated Fields Form from codepeople. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not properly neutralizing HTML elements from submitted forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views form submissions in their email.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| codepeople | Calculated Fields Form | 0 – through 5.2.45 |
Weakness: CWE-75 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N