Calculated Fields Form < 5.2.64 - Admin+ Stored XSS

Vulnerability

The Calculated Fields Form WordPress plugin before version 5.2.64 does not sanitize and escape some of its settings. This allows high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disallowed, such as in multisite setups [1].

Exploitation

An attacker must have administrative access to the WordPress site. They can inject malicious JavaScript code into plugin settings, which is then stored and executed whenever the settings page is viewed or the injected content is rendered. The attack does not require the unfiltered_html capability, bypassing typical restrictions in multisite environments [1].

Impact

Successful exploitation leads to stored XSS, allowing the attacker to execute arbitrary JavaScript in the context of the admin dashboard. This can result in session hijacking, defacement, or further compromise of the site [1].

Mitigation

Update to version 5.2.64 or later, which fixes the vulnerability by properly sanitizing and escaping the settings. No other workarounds are mentioned in the advisory [1].