CVE-2026-95529 Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions

Description

Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.

Affected products and versions

Product	Affected versions	Fixed in
Calculated Fields Form 5.5	earliest → 5.5.1.1	No fix stated

Other CVEs of Calculated Fields Form

The 12 CVEs of Calculated Fields Form →

CVE-2026-3986 The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in… 6.4 Medium CVE-2026-25368 Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting… 6.5 Medium CVE-2025-49291 Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross… 4.3 Medium CVE-2024-12601 The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including,… 5.3 Medium