Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-103909 · Microsoft / collected KEV context

cve-program · CVE-2026-103909

• https://www.wordfence.com/threat-intel/vulnerabilities/id/fd61aa6f-79c5-4f81-964e-e71412d45b35?source=cve
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.5/js/fields-public/fbuilder.fcalculated.js#L416
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.5/js/fields-public/fbuilder.fcalculated.js#L389
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.5/js/fbuilder-pro-public.jquery.js#L167
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.5/js/fbuilder-pro-public.jquery.js#L1288
• https://plugins.trac.wordpress.org/browser/calculated-fields-form/tags/5.5.1.5/js/modules/08_url/public/01_url.js#L140
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3724009%40calculated-fields-form&new=3724009%40calculated-fields-form

No related operational record is retained in the current change model.