Unauthenticated Cross Site Scripting vulnerabilities in the Calculated Fields Form plugin enable malicious actors to inject arbitrary script content that will run in the context of the site visitor’s browser. This can lead to cookie theft, session hijacking, or defacement. The weakness is a classic reflected XSS flaw where user-supplied data is not properly validated, corresponding to CWE-79.

The issue affects the WordPress Calculated Fields Form plugin from the vendor codepeople, specifically any version 5.5.1.1 or earlier. No further vendor product details are listed beyond the plugin name.

The CVSS score of 7.1 indicates a high severity, but the EPSS score is not available, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers can target unauthenticated users by embedding malicious input in form fields, which the plugin then reflects back to the browser. The lack of input sanitization permits the payload to execute in the victim’s session.