WordPress Plugin Vulnerabilities

Calculated Fields Form < 1.2.53 - Contributor+ Stored XSS

Description

The plugin does not validate and escape some the location attribute of its CP_CALCULATED_FIELDS shortcode before outputting it back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affects Plugins

Plugin icon
calculated-fields-form
Fixed in 1.2.53

References

CVE
CVE-2024-0963
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/d870ff8d-ea4b-4777-9892-0d9982182b9f

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Richard Telleng (stueotue)
Verified
No
WPVDB ID
71b12ab7-94d6-45a1-937f-240a0fa604eb

Timeline

Publicly Published
2024-02-01 (about 2 years ago)
Added
2024-02-02 (about 2 years ago)
Last Updated
2024-02-02 (about 2 years ago)

Other

Published
Title
Published
2021-06-21
Title
Prismatic < 2.8 - Contributor+ Stored XSS
Published
2025-08-14
Title
12 Step Meeting List < 3.18.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-02-10
Title
OpenPOS Lite < 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Published
2023-10-12
Title
BuddyPress Global Search <= 1.2.1 - Admin+ Stored XSS
Published
2024-09-03
Title
Gutenberg Page Builder Blocks & Ready-Made Patterns Library < 3.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting