CVE-2024-9940 describes an HTML Injection vulnerability in the codepeople Calculated Fields Form WordPress plugin, affecting all versions up to and including 5.2.45. The issue arises from failure to properly neutralize HTML elements submitted through forms, allowing unauthenticated attackers to inject arbitrary HTML content. This injected HTML is rendered when administrators view form submissions in their email clients, potentially leading to user interface manipulation or other impacts related to HTML injection. The vulnerability is identified as CWE-75 (Failure to Sanitize Special Elements into a Different Plane). The CVSS 3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The vulnerability allows unauthenticated attackers to inject arbitrary HTML content into form submissions that are later rendered in administrator emails. This can lead to integrity issues such as UI manipulation or misleading content display when administrators review submissions. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when reviewing form submissions and consider additional email filtering or sanitization controls. Monitoring vendor channels for updates or patches is recommended.