CVE-2023-6446

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-87 CWE-79

Affected software

Vendor	Product	Versions
codepeople	Calculated Fields Form	<= 1.2.40

References

https://plugins.trac.wordpress.org/changeset/3005354/calculated-fields-formRelease Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/c879123c-531e-43d8-a7d3-16a3c86b68a3?source=cveProduct, Third Party Advisory
https://plugins.trac.wordpress.org/changeset/3005354/calculated-fields-formRelease Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/c879123c-531e-43d8-a7d3-16a3c86b68a3?source=cveProduct, Third Party Advisory

Timeline

Published: Jan 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-64475.3The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and CVE-2023-64489.8Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticat CVE-2023-64497.2The Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'validate' f CVE-2023-64505.5An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, result CVE-2023-64517.5Publicly known cryptographic machine key in AlayaCare's Procura Portal before 9.0.1.2 allows attackers to forge their own authentication coo CVE-2023-64529.6Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Web Security (Transaction V CVE-2023-64564.8The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users CVE-2023-64577.1Incorrect Default Permissions vulnerability in Hitachi Tuning Manager on Windows (Hitachi Tuning Manager server component) allows local user CVE-2023-64589.8Mattermost webapp fails to validate route parameters in/<TEAM_NAME>/channels/<CHANNEL_NAME> allowing an attacker to perform a client-side pa CVE-2023-64595.3Mattermost is grouping calls in the /metrics endpoint by id and reports that id in the response. Since this id is the channelID, the public CVE-2023-64605.5A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._sett CVE-2023-64616.1Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0.