Extension WordPress
Vulnérabilités Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
Cette page rassemble les failles publiées pour Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
18 fiches
Calculated Fields Form <= 5.4.5.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5.0. This is due to insufficient capability checks on the form settings save handler…
*-5.4.5.0
5.4.5.1
12/03/2026
Calculated Fields Form <= 5.4.4.1 – Missing Authorization
The Calculated Fields Form plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.4.4.1. This makes it possible for authenticated attackers, with contributor-level access…
*-5.4.4.1
5.4.4.2
16/02/2026
Calculated Fields Form <= 5.3.58 – Cross-Site Request Forgery
The Calculated Fields Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.3.58. This is due to missing or incorrect nonce validation on a function. This makes it possible for…
*-5.3.58
5.3.59
05/06/2025
Calculated Fields Form <= 5.2.61 – Authenticated (Admin+) Stored Cross-Site Scripting
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.2.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-5.2.61
5.2.62
09/04/2025
Calculated Fields Form <= 5.2.61 – Authenticated (Admin+) Stored Cross-Site Scripting
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.2.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-5.2.61
5.2.62
08/04/2025
Calculated Fields Form <= 5.2.63 – Authenticated (Admin+) Stored Cross-Site Scripting
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.2.63 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-5.2.63
5.2.64
02/03/2025
Calculated Fields Form <= 5.2.63 – Denial of Service
The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited height and width parameters for CAPTCHA images. This makes it possible for…
*-5.2.63
5.2.64
16/12/2024
Calculated Fields Form <= 5.2.45 – HTML Injection
The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not properly neutralizing HTML elements from submitted forms. This makes it possible…
*-5.2.45
5.2.46
16/10/2024
Calculated Fields Form <= 1.2.54 – Reflected Cross-Site Scripting
The Calculated Fields Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 1.2.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers…
*-1.2.54
1.2.55
25/03/2024
Calculated Fields Form Professional <= 5.1.56 – Unauthenticated Stored Cross-Site Scripting
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and including, 5.1.56 due to insufficient input sanitization and output escaping. This makes it…
*-5.1.56
5.1.57
01/03/2024
Calculated Fields Form <= 1.2.52 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping on user supplied 'location'…
*-1.2.52
1.2.53
01/02/2024
Calculated Fields Form <= 1.2.28 – Authenticated (Contributor+) Open Redirect via Shortcode
The Calculated Fields Form plugin for WordPress is vulnerable to Open Redirect via the plugin's shortcode(s) in all versions up to 1.2.29 (exclusive) due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…
*-1.2.28
1.2.29
27/12/2023
Calculated Fields Form <= 1.2.40 – Authenticated (Admin+) Stored Cross-Site Scripting
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-1.2.40
1.2.41
05/12/2023
Calculated Fields Form <= 1.1.120 – Cross-Site Request Forgery
The Calculated Fields Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.120. This is due to missing or incorrect nonce validation on the feedback_action function. This makes it possible for…
*-1.1.120
1.1.121
02/03/2023
Calculated Fields Form <= 1.1.120 – Missing Authorization to Feedback Submission
The Calculated Fields Form plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on the feedback_action function in versions up to, and including, 1.1.120. This makes it possible for authenticated attackers…
*-1.1.120
1.1.121
28/02/2023
Calculated Fields Form <= 1.1.150 – Authenticated (Administrator+) Stored Cross-Site Scripting
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.1.150 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
*-1.1.150
1.1.151
22/02/2023
Calculated Fields Form <= 1.0.353 – Authenticated Stored Cross-Site Scripting
The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user.
*-1.0.353
1.0.354
22/01/2020
Calculated Fields Form <= 1.0.11 – Cross-Site Request Forgery to SQL Injection
The Calculated Fields Form plugin for WordPress is vulnerable to SQL Injection via Cross-Site Request Forgery in versions up to, and including, 1.0.11 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the…
*-1.0.11
1.0.12
02/03/2015
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.