Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-100184 · Microsoft / collected KEV context

cve-program · CVE-2026-100184

• https://www.wordfence.com/threat-intel/vulnerabilities/id/6f1d2fe6-6cee-4e21-85ac-37d2d48156d2?source=cve
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.2/js/fbuilder-pro-public.jquery.js#L692
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.2/js/fields-public/05_fbuilder.ftextarea.js#L23
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.2/js/fbuilder-pro-public.jquery.js#L1288
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.2/js/modules/08_url/public/01_url.js#L140
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3713574%40calculated-fields-form&new=3713574%40calculated-fields-form

No related operational record is retained in the current change model.