CVE-2024-2020 is a stored cross-site scripting vulnerability (CWE-79) in the Calculated Fields Form WordPress plugin, affecting versions up to 5.1.56. The vulnerability is due to improper neutralization of input in the form page href parameter, enabling unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the injected pages. Exploitation requires the professional or higher version of the plugin. The CVSS 3.1 score is 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in users' browsers. This can compromise user confidentiality and integrity by stealing session tokens, performing actions on behalf of users, or defacing content. Availability is not impacted. The vulnerability requires the professional version or higher, limiting exposure to users of that edition.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users of the professional or higher versions of the Calculated Fields Form plugin should consider disabling or restricting access to vulnerable functionality to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.