CVE-2024-12273
CVSS 3.1 Score 3.5 of 10 (low)
Details
Published Apr 29, 2025
CWE ID 79
Summary
CVE-2024-12273 is a vulnerability affecting the Calculated Fields Form plugin for WordPress before version 5.2.62. This issue arises from the plugin's failure to sanitize and escape certain settings, making it susceptible to Stored Cross-Site Scripting (XSS) attacks. High privilege users, including administrators, can exploit this vulnerability, even when the "unfiltered_html" capability is denied, particularly in multisite setups.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Codepeople