This vulnerability (CVE-2024-29759) in CodePeople Calculated Fields Form is a reflected cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. It affects versions up to 1.2.54 and can be exploited remotely without privileges, requiring user interaction. The CVSS 3.1 base score is 7.1, indicating high severity with impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The reflected nature requires user interaction to trigger the attack. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts and avoid exposing vulnerable plugin versions publicly. Monitor vendor channels for updates and apply patches promptly once released.