Stored XSS Vulnerabilities in Calculated Fields Form for WordPress
CVE-2020-7228

5.4MEDIUM

Key Information:

Vendor

Wordpress
Status
Calculated Fields Form
Vendor
CVE Published:
22 January 2020

What is CVE-2020-7228?

The Calculated Fields Form plugin for WordPress is susceptible to multiple stored cross-site scripting (XSS) vulnerabilities found in input forms. These vulnerabilities can be exploited by authenticated users, potentially allowing them to execute arbitrary JavaScript code in the context of other users. This creates security issues that can lead to data leakage or unauthorized actions within the site.

References

https://wordpress.org/plugins/calculated-fields-form/#dev...
x_refsource_MISC
https://spider-security.co.uk/blog-cve-2020-7228
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/10043
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.