CVE-2024-29759: Calculated Fields Form XSS Vulnerability

CVE-2024-29759 Overview

CVE-2024-29759 is a reflected cross-site scripting (XSS) vulnerability in the CodePeople Calculated Fields Form plugin for WordPress. The flaw stems from improper neutralization of user-supplied input during web page generation, classified under [CWE-79]. It affects all plugin versions up to and including 1.2.54. An unauthenticated attacker can craft a malicious URL that, when clicked by a victim, executes attacker-controlled script in the victim's browser session. The vulnerability requires user interaction and executes across a security scope boundary, allowing script execution against the WordPress site context.

Critical Impact
A successful attack executes arbitrary JavaScript in the victim's browser, enabling session hijacking, credential theft, and unauthorized actions on the affected WordPress site.

Affected Products

CodePeople Calculated Fields Form for WordPress, versions up to and including 1.2.54
WordPress installations using the affected plugin
Sites exposing plugin-handled forms to unauthenticated visitors

Discovery Timeline

2024-03-27 - CVE-2024-29759 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29759

Vulnerability Analysis

The Calculated Fields Form plugin fails to sanitize or encode user-controlled input before reflecting it into rendered HTML output. This produces a reflected XSS condition where malicious payloads travel through request parameters and execute in the browser of any user who follows a crafted link. Because the vulnerability crosses a security scope boundary, the injected script can interact with content beyond the immediate vulnerable component. Exploitation requires that a victim click a malicious link or visit an attacker-controlled page. The impact includes theft of authentication cookies, forced browser actions on behalf of the victim, and delivery of secondary payloads through the trusted WordPress origin.

Root Cause

The root cause is missing or insufficient output encoding of request-supplied values in the plugin's form-rendering code paths. Input arrives through HTTP request parameters and is written into the HTML response without contextual escaping. Refer to the Patchstack XSS Vulnerability Report for the specific parameter and code path details.

Attack Vector

An attacker crafts a URL containing a JavaScript payload in a vulnerable parameter processed by the plugin. The attacker distributes this URL through phishing email, social media, or a malicious page. When a WordPress user or administrator follows the link, the reflected payload executes under the origin of the WordPress site. Post-exploitation actions typically include stealing session cookies, submitting forged form requests, or redirecting the browser to attacker infrastructure.

Detection Methods for CVE-2024-29759

Indicators of Compromise

HTTP requests to Calculated Fields Form endpoints containing <script>, javascript:, onerror=, or encoded equivalents in query parameters
Referrer chains showing users arriving at plugin URLs from unrelated external domains
Unexpected outbound requests from browsers to attacker-controlled hosts following plugin page loads
Web server logs with unusually long or URL-encoded parameter values targeting plugin routes

Detection Strategies

Deploy web application firewall rules that inspect query strings for reflected XSS payloads targeting the plugin
Compare request parameter values against server response bodies to identify reflected content without encoding
Monitor WordPress plugin inventories for installations of Calculated Fields Form at or below version 1.2.54

Monitoring Recommendations

Enable verbose HTTP access logging for /wp-content/plugins/calculated-fields-form/ and related endpoints
Alert on Content Security Policy violation reports originating from plugin-rendered pages
Correlate authentication anomalies with recent visits to plugin URLs containing suspicious parameters

How to Mitigate CVE-2024-29759

Immediate Actions Required

Update the Calculated Fields Form plugin to a version later than 1.2.54 as soon as a fixed release is available
Audit WordPress sites for the presence and version of the affected plugin using the WordPress admin plugin inventory
Force session invalidation for administrators who may have clicked untrusted links referencing the plugin
Review web server and WAF logs for reflected XSS payload patterns against plugin endpoints

Patch Information

Consult the Patchstack XSS Vulnerability Report and the CodePeople plugin changelog for the fixed version. Apply the vendor-supplied update through the WordPress plugin manager and verify the installed version reports higher than 1.2.54 after the update.

Workarounds

Deploy a web application firewall with signatures blocking reflected XSS payloads on plugin URLs
Implement a strict Content Security Policy that disallows inline script and restricts script sources
Temporarily disable the Calculated Fields Form plugin if patching is not immediately feasible
Restrict administrative access to trusted networks to limit exposure of high-value sessions

bash

# Configuration example: verify installed plugin version via WP-CLI
wp plugin get calculated-fields-form --field=version
wp plugin update calculated-fields-form