Calculated Fields Form Vulnerable to Reflected XSS

CVE-2024-29759

Summary

The Calculated Fields Form product by CodePeople contains a vulnerability related to improper neutralization of user input during the web page generation process, specifically leading to Reflected Cross-Site Scripting (XSS). This allows an attacker to execute arbitrary scripts in the context of the user's browser. Affected versions include all prior to 1.2.54, putting websites utilizing this form plugin at risk. A successful exploit could allow attackers to manipulate user sessions, deface web content, or redirect users to malicious sites.

References