CVE Vulnerabilities

CVE-2024-9940

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Published: Oct 17, 2024 | Modified: Jun 05, 2025
CVSS 3.x
4.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
root.io minimus.io echohq.com

The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not properly neutralizing HTML elements from submitted forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views form submissions in their email.

Weakness

The product does not adequately filter user-controlled input for special elements with control implications.

Affected Software

Name Vendor Start Version End Version
Calculated_fields_form Codepeople * 5.2.46 (excluding)

Potential Mitigations

References