Calculated Fields Form < 1.1.151 - Admin+ Stored Cross-Site Scripting via Dropdown Fields

Vulnerability

The Calculated Fields Form WordPress plugin, version 1.1.151 and earlier, contains a stored cross-site scripting (XSS) vulnerability in form settings. The plugin fails to sanitize and escape certain form settings before output, allowing high-privilege users (e.g., admin) to inject arbitrary web scripts. This is exploitable even when the unfiltered_html capability is disallowed, such as in a multisite setup [1].

Exploitation

An attacker with admin-level access to the WordPress dashboard can navigate to the form settings for a Calculated Fields Form and inject a malicious script into one of the unsanitized fields. The payload is stored and later executed when any user (including lower-privilege users) views the form on the front end. No additional user interaction is required beyond viewing the affected page [1].

Impact

Successful exploitation results in stored XSS, enabling the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, redirects, or theft of sensitive information. The attack is performed from an admin-level account, but the impact affects any visitor to the page containing the injected form [1].

Mitigation

The vulnerability has been fixed in version 1.1.151 of the plugin, released on or before 2023-02-22 [1]. Users should update immediately. No workaround is provided for older versions. The plugin does not have a known public exploit listing on CISA's KEV at this time.