CVE-2024-9940: 
WordPress vulnerability analysis and mitigation

The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in versions up to and including 5.2.45. This vulnerability was discovered and disclosed on October 16, 2024, affecting the form submission functionality of the plugin (NVD, WPScan).

The vulnerability stems from the plugin's failure to properly neutralize HTML elements from submitted forms. The issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-75 (Failure to Sanitize Special Elements into a Different Plane) (NVD).

When exploited, this vulnerability allows unauthenticated attackers to inject arbitrary HTML that will render when the administrator views form submissions in their email. This could potentially lead to various security issues including phishing attempts or malicious script execution in the administrator's email context (WPScan).

The vulnerability has been patched in version 5.2.46 of the Calculated Fields Form plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).