Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 18 vulnerability records associated with Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More, published between 2015 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

18Total records
1Critical
1High
16Medium
0Low
0Informational
18Patched records
0Currently marked unpatched
2015-03-02First disclosure
2026-03-12Latest disclosure
17 of 18CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201511 records
202011 records
202355 records
202455 records
202544 records
202622 records

Severity Breakdown

SeverityRecordsShare
Critical15.6%
High15.6%
Medium1688.9%

Vulnerability-Type Breakdown

Cross-Site Scripting

10 records55.6%

First: 2020. Latest: 2026.

CSRF

3 records16.7%

First: 2015. Latest: 2025.

Other

3 records16.7%

First: 2023. Latest: 2024.

Missing Authorization

2 records11.1%

First: 2023. Latest: 2026.

Patch Status

Patched
18
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 5.4.5.1
  • 5.4.4.2
  • 5.3.59
  • 5.2.62
  • 5.2.64
  • 5.2.46
  • 1.2.55
  • 5.1.57
  • 1.2.53
  • 1.2.29
  • 1.2.41
  • 1.1.121
  • 1.1.151
  • 1.0.354
  • 1.0.12

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-5.4.5.0Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form SettingsMarch 12, 20265.4.5.1Medium
*-5.4.4.1Calculated Fields Form <= 5.4.4.1 - Missing AuthorizationFebruary 16, 20265.4.4.2Medium
*-5.3.58Calculated Fields Form <= 5.3.58 - Cross-Site Request ForgeryJune 5, 20255.3.59Medium
*-5.2.61Calculated Fields Form <= 5.2.61 - Authenticated (Admin+) Stored Cross-Site ScriptingApril 9, 20255.2.62Medium
*-5.2.61Calculated Fields Form <= 5.2.61 - Authenticated (Admin+) Stored Cross-Site ScriptingApril 8, 20255.2.62Medium
*-5.2.63Calculated Fields Form <= 5.2.63 - Authenticated (Admin+) Stored Cross-Site ScriptingMarch 2, 20255.2.64Medium
*-5.2.63Calculated Fields Form <= 5.2.63 - Denial of ServiceDecember 16, 20245.2.64Medium
*-5.2.45Calculated Fields Form <= 5.2.45 - HTML InjectionOctober 16, 20245.2.46Medium
*-1.2.54Calculated Fields Form <= 1.2.54 - Reflected Cross-Site ScriptingMarch 25, 20241.2.55Medium
*-5.1.56Calculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site ScriptingMarch 1, 20245.1.57High
*-1.2.52Calculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site ScriptingFebruary 1, 20241.2.53Medium
*-1.2.28Calculated Fields Form <= 1.2.28 - Authenticated (Contributor+) Open Redirect via ShortcodeDecember 27, 20231.2.29Medium
*-1.2.40Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site ScriptingDecember 5, 20231.2.41Medium
*-1.1.120Calculated Fields Form <= 1.1.120 - Cross-Site Request ForgeryMarch 2, 20231.1.121Medium
*-1.1.120Calculated Fields Form <= 1.1.120 - Missing Authorization to Feedback SubmissionFebruary 28, 20231.1.121Medium
*-1.1.150Calculated Fields Form <= 1.1.150 - Authenticated (Administrator+) Stored Cross-Site ScriptingFebruary 22, 20231.1.151Medium
*-1.0.353Calculated Fields Form <= 1.0.353 - Authenticated Stored Cross-Site ScriptingJanuary 22, 20201.0.354Medium
*-1.0.11Calculated Fields Form <= 1.0.11 - Cross-Site Request Forgery to SQL InjectionMarch 2, 20151.0.12Critical

Selected source records

Latest Records

MediumCVE-2026-3986

Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings

Published: March 12, 2026

Affected versions
*-5.4.5.0
Patched versions
5.4.5.1
Original Wordfence record
MediumCVE-2026-25368

Calculated Fields Form <= 5.4.4.1 - Missing Authorization

Published: February 16, 2026

Affected versions
*-5.4.4.1
Patched versions
5.4.4.2
Original Wordfence record
MediumCVE-2025-49291

Calculated Fields Form <= 5.3.58 - Cross-Site Request Forgery

Published: June 5, 2025

Affected versions
*-5.3.58
Patched versions
5.3.59
Original Wordfence record
MediumCVE-2024-13381

Calculated Fields Form <= 5.2.61 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: April 9, 2025

Affected versions
*-5.2.61
Patched versions
5.2.62
Original Wordfence record
MediumCVE-2024-12273

Calculated Fields Form <= 5.2.61 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: April 8, 2025

Affected versions
*-5.2.61
Patched versions
5.2.62
Original Wordfence record
MediumCVE-2024-13382

Calculated Fields Form <= 5.2.63 - Authenticated (Admin+) Stored Cross-Site Scripting

Published: March 2, 2025

Affected versions
*-5.2.63
Patched versions
5.2.64
Original Wordfence record
MediumCVE-2024-12601

Calculated Fields Form <= 5.2.63 - Denial of Service

Published: December 16, 2024

Affected versions
*-5.2.63
Patched versions
5.2.64
Original Wordfence record
MediumCVE-2024-9940

Calculated Fields Form <= 5.2.45 - HTML Injection

Published: October 16, 2024

Affected versions
*-5.2.45
Patched versions
5.2.46
Original Wordfence record

Highest-Severity Records

Critical

Calculated Fields Form <= 1.0.11 - Cross-Site Request Forgery to SQL Injection

Published: March 2, 2015

Affected versions
*-1.0.11
Patched versions
1.0.12
Original Wordfence record
HighCVE-2024-2020

Calculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site Scripting

Published: March 1, 2024

Affected versions
*-5.1.56
Patched versions
5.1.57
Original Wordfence record
MediumCVE-2026-3986

Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings

Published: March 12, 2026

Affected versions
*-5.4.5.0
Patched versions
5.4.5.1
Original Wordfence record
MediumCVE-2024-0963

Calculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 1, 2024

Affected versions
*-1.2.52
Patched versions
1.2.53
Original Wordfence record
MediumCVE-2024-29759

Calculated Fields Form <= 1.2.54 - Reflected Cross-Site Scripting

Published: March 25, 2024

Affected versions
*-1.2.54
Patched versions
1.2.55
Original Wordfence record
MediumCVE-2020-7228

Calculated Fields Form <= 1.0.353 - Authenticated Stored Cross-Site Scripting

Published: January 22, 2020

Affected versions
*-1.0.353
Patched versions
1.0.354
Original Wordfence record
MediumCVE-2024-12601

Calculated Fields Form <= 5.2.63 - Denial of Service

Published: December 16, 2024

Affected versions
*-5.2.63
Patched versions
5.2.64
Original Wordfence record
MediumCVE-2024-9940

Calculated Fields Form <= 5.2.45 - HTML Injection

Published: October 16, 2024

Affected versions
*-5.2.45
Patched versions
5.2.46
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory