Stored Cross-Site Scripting in Calculated Fields Form for WordPress

CVE-2026-3986

What is CVE-2026-3986?

The Calculated Fields Form plugin for WordPress is susceptible to Stored Cross-Site Scripting vulnerabilities due to inadequate capability checks and insufficient input sanitization in specific form settings. This flaw allows authenticated users with Contributor-level access and above to inject malicious scripts through the form settings, leading to the execution of these scripts on web pages whenever accessed by users. This could potentially expose users to various security threats, highlighting the need for prompt updates and improved security measures.

References