CVE-2026-100179 is a reflected DOM-based cross-site scripting vulnerability in the Calculated Fields Form – AI Form Builder for WordPress plugin (up to version 5.5.1.3). The vulnerability occurs because the plugin uses URL parameters directly in calculated equations without proper sanitization or escaping. Specifically, when a public form is configured with a Select2-enabled dropdown whose choices are set via a calculated equation that pipes a URL parameter through GETURLPARAMETER() into setChoices({texts:[...]}), an attacker can craft a malicious link that injects arbitrary JavaScript. This script executes in the context of the victim's browser upon clicking the link, potentially leading to information disclosure or session hijacking.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the victim's browser when the victim interacts with a crafted link. This can lead to information disclosure and limited integrity impact, but does not affect availability. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor's advisory for updates. Until a fix is available, avoid using public forms with Select2-enabled dropdowns populated via calculated equations that consume URL parameters. Additionally, do not click on suspicious links that may exploit this vulnerability.