The Calculated Fields Form plugin for WordPress has a stored cross‑site scripting flaw caused by missing capability checks on the form settings save handler and unsanitized input of the fcontent field in fhtml field types. The vulnerability allows an authenticated user with Contributor level access or higher to inject arbitrary JavaScript, which is stored and subsequently executed whenever a page containing the injected form is loaded in a visitor’s browser. This can lead to session hijacking, defacement, or other browser‑side attacks that compromise the confidentiality and integrity of the site’s data.

Any WordPress installation that runs CodePeople’s Calculated Fields Form plugin version 5.4.5.0 or earlier is affected. The flaw is present in all releases up to and including 5.4.5.0, as confirmed by the plugin’s source code for versions 5.4.4.5 and older.

The CVSS v3.1 score of 6.4 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with Contributor–level privileges or higher, meaning an insider or a compromised contributor account is the most likely attacker. Overall, the risk is moderate, but the impact could be significant if an attacker can execute script in visitors’ browsers.