PT-2026-25161 · Codepeople · Calculated Fields Form

Hunter Jensen · Published 2026-03-13 · Updated 2026-03-13 · CVE-2026-3986

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Calculated Fields Form plugin for WordPress versions up to and including 5.4.5.0

Description The Calculated Fields Form plugin for WordPress is susceptible to Stored Cross-Site Scripting through the form settings. This is caused by inadequate capability checks during the form settings save process and insufficient sanitization of the fcontent field within fhtml field types. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which will execute when a user accesses the affected page. The vulnerable component is the form settings save handler. The vulnerable parameter is fcontent.

Recommendations Update the Calculated Fields Form plugin to a version later than 5.4.5.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3986

Affected Products

Calculated Fields Form

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-3986 · Security Note
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.4.4.5/inc/cpcff_page_builders.inc.php#L41 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d650261a-ec0a-4538-ad59-0589712702fa?source=cve · Note
• https://t.me/CVEtracker/47343 · Telegram Post
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/trunk/cp_calculatedfieldsf_free.php#L131 · Note
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.4.4.5/cp_calculatedfieldsf_free.php#L131 · Note
• https://twitter.com/infoflowcloud/status/2032389021981122679 · Twitter Post
• https://twitter.com/CVEnew/status/2032387543367639225 · Twitter Post
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.4.4.5/inc/cpcff_form.inc.php#L326 · Note