Fiche vulnérabilité
CVE-2024-13381 : faille moyenne codepeople calculated fields form (CVSS 4.8)
Description
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
En bref
- Sévérité
- Moyenne (CVSS 4.8)
- Vecteur CVSS
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- Exploitation active
- Non signalée par la CISA
- Publication
- 1 mai 2025
- Dernière mise à jour
- 17 juin 2026
Produits concernés
- codepeople calculated fields form