CVE-2026-100184

Name of the Vulnerable Software and Affected Versions Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More versions prior to 5.5.1.4

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected DOM-Based Cross-Site Scripting. This occurs when a targeted form has a Text Area field configured with a url.<name> predefined value and predefinedClick disabled. An attacker can inject arbitrary web scripts via the x (attacker-chosen name matching the form's url.<name> predefined value) parameter, which execute if a user is tricked into clicking a malicious link.

Recommendations Update to version 5.5.1.4 or later. As a temporary mitigation, avoid using the url.<name> predefined value in Text Area fields until the update is applied.