CVE-2026-100184 describes a reflected DOM-based cross-site scripting vulnerability in the Calculated Fields Form – AI Form Builder for WordPress plugin. The flaw exists in all versions up to and including 5.5.1.3 due to improper neutralization of input during web page generation. Specifically, the 'x' parameter, which matches the form's url.<name> predefined value, is not properly sanitized or escaped, enabling injection of arbitrary web scripts. Successful exploitation requires the form to have a Text Area field with a 'url.<name>' predefined value and predefinedClick disabled, allowing unauthenticated attackers to trick users into executing malicious scripts by clicking crafted links.

An attacker can inject arbitrary scripts that execute in the context of the victim's browser when the victim interacts with a specially crafted link. This can lead to limited confidentiality and integrity impacts, such as theft of user data or session tokens. The vulnerability does not allow privilege escalation or availability impact. Exploitation requires user interaction and specific form configuration.

No official patch or fix is currently documented. Users should verify if a vendor advisory or update is available. Until a fix is released, avoid using Text Area fields with 'url.<name>' predefined values and predefinedClick disabled, or restrict access to vulnerable forms. Monitor vendor channels for updates and apply patches promptly once available.