CVE-2024-13382: 
WordPress vulnerability analysis and mitigation

The Calculated Fields Form WordPress plugin before version 5.2.64 contains a stored Cross-Site Scripting (XSS) vulnerability. The plugin fails to properly sanitize and escape some of its settings, which affects high privilege users such as administrators, particularly in multisite setups where the unfiltered_html capability is disallowed (WPScan).

The vulnerability exists in the plugin's settings functionality, specifically affecting the 'Acceptance (GDPR)' field settings. When creating a new form with this field type, the 'Field label' input is not properly sanitized, allowing for the injection of malicious JavaScript code. The vulnerability has been assigned a CVSS score of 3.5 (low) (WPScan, Wiz).

The vulnerability allows high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks. This is particularly significant in multisite WordPress setups where the unfiltered_html capability is typically disallowed as a security measure (WPScan).

The vulnerability has been patched in version 5.2.64 of the Calculated Fields Form WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).