CVE-2026-103909 describes a reflected DOM-based cross-site scripting vulnerability in the Calculated Fields Form – AI Form Builder for WordPress plugin. The flaw exists in all versions up to and including 5.5.1.5 due to improper neutralization of input during web page generation (CWE-79). Specifically, the vulnerability is triggered via arbitrary URL parameters named by the administrator (url.<name>) used in concatenation equations within publicly accessible forms. This allows unauthenticated attackers to inject and execute arbitrary web scripts if they can trick users into clicking malicious links. The vulnerability requires a form configuration with at least two such URL-bound fields used together, which is a plausible but not guaranteed setup.

Successful exploitation can lead to limited confidentiality and integrity impacts by executing arbitrary scripts in the context of the victim's browser session. This can result in theft of sensitive information or manipulation of the user interface. There is no impact on availability. The vulnerability is exploitable without authentication but requires user interaction (clicking a crafted link).

No official patch or fix is currently documented. Users should check the vendor advisory for updates. Until a fix is available, administrators should avoid configurations that use multiple URL-bound fields concatenated in equations within publicly accessible forms. Additionally, restricting user interaction with untrusted links can reduce risk. Monitor vendor channels for official patches or updates.