VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More security & vulnerabilities

calculated-fields-form— active installsLast vulnerability Nov 9, 2026

No known unpatched vulnerabilities in the latest version

All 23 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
23Known vulnerabilities
  • Critical1
  • High3
  • Medium19
  • Low0
Vulnerabilities per year
2015: 1 vulnerability1152020: 1 vulnerability1202023: 5 vulnerabilities5232024: 5 vulnerabilities5242025: 4 vulnerabilities4252026: 7 vulnerabilities726

All Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More vulnerabilities

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting
≤5.5.2.8Update to 5.5.2.9
CVE-2026-124253
Medium6.1Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation
≤5.5.1.5Update to 5.5.1.6
CVE-2026-103909
Medium4.7Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value
≤5.5.1.3Update to 5.5.1.4
CVE-2026-100184
Medium6.1Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
≤5.5.1.3Update to 5.5.1.4
CVE-2026-100179
High7.2Unauthenticated Stored Cross-Site Scripting
≤5.5.1.1Update to 5.5.1.2
CVE-2026-95529
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings
≤5.4.5.0Update to 5.4.5.1
CVE-2026-3986
Medium4.3Missing Authorization
≤5.4.4.1Update to 5.4.4.2
CVE-2026-25368
Medium4.3Cross-Site Request Forgery
≤5.3.58Update to 5.3.59
CVE-2025-49291
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤5.2.61Update to 5.2.62
CVE-2024-13381
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤5.2.61Update to 5.2.62
CVE-2024-12273
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤5.2.63Update to 5.2.64
CVE-2024-13382
Medium5.3Denial of Service
≤5.2.63Update to 5.2.64
CVE-2024-12601
Medium5.3HTML Injection
≤5.2.45Update to 5.2.46
CVE-2024-9940
Medium6.1Reflected Cross-Site Scripting
≤1.2.54Update to 1.2.55
CVE-2024-29759
High7.2Unauthenticated Stored Cross-Site Scripting
≤5.1.56Update to 5.1.57
CVE-2024-2020
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.2.52Update to 1.2.53
CVE-2024-0963
Medium4.3Authenticated (Contributor+) Open Redirect via Shortcode
≤1.2.28Update to 1.2.29
CVE-2023-51517
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤1.2.40Update to 1.2.41
CVE-2023-6446
Medium4.3Cross-Site Request Forgery
≤1.1.120Update to 1.1.121
CVE-2023-26523
Medium4.3Missing Authorization to Feedback Submission
≤1.1.120Update to 1.1.121
—
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤1.1.150Update to 1.1.151
CVE-2023-0389
Medium5.4Authenticated Stored Cross-Site Scripting
≤1.0.353Update to 1.0.354
CVE-2020-7228
Critical9.8Cross-Site Request Forgery to SQL Injection
≤1.0.11Update to 1.0.12
—

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More: common questions

Does Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More have known vulnerabilities?

Yes. VulnCrest Radar lists 23 known vulnerabilities in Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More: 1 critical, 3 high, 19 medium. None are known to affect version null.

How do I check which version of Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More vulnerability?

CVE-2026-124253, published Nov 9, 2026: Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More <= 5.5.2.8 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).

Is any Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More vulnerability listed in CISA KEV?

No. None of the known Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?