1. Home
  2. CVE Database
  3. CVE-2024-9940
MEDIUM · 5.3

CVE-2024-9940

The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not properly neutralizing HTML elements from sub...

Vulnerability Description

The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not properly neutralizing HTML elements from submitted forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views form submissions in their email.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
CodepeopleCalculated Fields Form< 5.2.46

Related Weaknesses (CWE)

CWE-75CWE-79

References

FAQ

What is CVE-2024-9940?

CVE-2024-9940 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not properly neutralizing HTML elements from sub...

How severe is CVE-2024-9940?

CVE-2024-9940 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-9940?

Check the references section above for vendor advisories and patch information. Affected products include: Codepeople Calculated Fields Form.