CVE-2026-95529: Calculated Fields Form XSS Vulnerability

CVE-2026-95529 Overview

CVE-2026-95529 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the Calculated Fields Form plugin for WordPress in versions up to and including 5.5.1.1. The flaw is categorized under [CWE-79], improper neutralization of input during web page generation. Attackers can inject malicious script content that executes in the browser context of a user who interacts with a crafted link or page. Exploitation requires user interaction but no authentication, and it can affect resources beyond the vulnerable component due to changed scope.

Critical Impact

Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling credential theft, session hijacking, and administrative account takeover on affected WordPress sites.

Affected Products

• Calculated Fields Form WordPress plugin, versions <= 5.5.1.1
• WordPress installations with the vulnerable plugin enabled
• Sites exposing plugin-rendered forms to unauthenticated visitors

Discovery Timeline

• 2026-09-23 - CVE-2026-95529 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95529

Vulnerability Analysis

The Calculated Fields Form plugin fails to properly neutralize user-controlled input before reflecting it into rendered HTML output. An unauthenticated attacker crafts a payload containing JavaScript and delivers it to a victim through a link, embedded content, or social engineering vector. When the victim loads the resulting page, the injected script executes in the origin of the WordPress site.

Because the vulnerability results in a scope change, the injected script can access resources and data associated with other components, including authenticated administrator sessions. Successful exploitation can lead to cookie theft, forced actions in the victim's context, page defacement, and pivoting toward full site compromise when an administrator triggers the payload.

Root Cause

The root cause is missing or insufficient output encoding of attacker-controlled input within the plugin's request-handling flow. Input received from HTTP parameters is embedded into HTML responses without contextual escaping, allowing script tags and event-handler attributes to survive into the rendered DOM. This is a classic [CWE-79] output-encoding failure.

Attack Vector

Exploitation is remote over the network and requires user interaction, such as clicking a crafted URL or visiting a page controlled by the attacker. No credentials on the target WordPress site are required. The vulnerability manifests when the plugin echoes attacker input into a response viewed by a victim.

No verified public proof-of-concept code is available for CVE-2026-95529. See the Patchstack XSS Vulnerability Advisory for advisory details.

Detection Methods for CVE-2026-95529

Indicators of Compromise

• Web server access logs containing URL parameters with <script>, onerror=, onload=, or encoded variants targeting Calculated Fields Form endpoints.
• Unexpected outbound requests from browsers loading plugin-rendered pages to attacker-controlled domains.
• Administrator session cookies appearing in referrer strings or being used from unfamiliar IP addresses.

Detection Strategies

• Inspect HTTP request logs for reflected parameter values that match known XSS payload patterns targeting form-handling endpoints.
• Deploy a web application firewall rule set that flags script-injection signatures in requests to /wp-content/plugins/calculated-fields-form/ paths.
• Correlate anomalous administrator activity with prior page loads containing suspicious query strings.

Monitoring Recommendations

• Enable verbose access logging on WordPress front-end endpoints and forward logs to a centralized analytics platform for query and retention.
• Monitor for new or modified administrator accounts, plugin installs, and theme edits following suspicious traffic.
• Alert on Content Security Policy (CSP) violation reports that indicate inline script execution on plugin-rendered pages.

How to Mitigate CVE-2026-95529

Immediate Actions Required

• Identify all WordPress sites running Calculated Fields Form and confirm the installed version.
• Update the plugin to a version later than 5.5.1.1 as soon as the vendor releases a fixed release.
• If a fix is not yet available, deactivate and remove the plugin from public-facing sites.

Patch Information

Refer to the Patchstack XSS Vulnerability Advisory for the latest patch status and recommended upgrade target for the Calculated Fields Form plugin.

Workarounds

• Restrict access to pages rendering the plugin form to authenticated users where feasible.
• Deploy a web application firewall (WAF) with rules that block reflected XSS payloads targeting plugin parameters.
• Enforce a strict Content Security Policy that blocks inline scripts and untrusted external script sources.
• Instruct administrators to avoid clicking untrusted links to the affected WordPress site until patching completes.

# Example: apply a restrictive Content-Security-Policy header via .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"