CVE-2025-49291

HIGH 8.8CVE-2025-49291 · Published 06/06/2025 · updated 17/06/2026

In short

CVE-2025-49291 is a HIGH (CVSS 8.8) vulnerability affecting calculated fields form (codepeople).
Chance of exploitation in the next 30 days (EPSS): 0.18%, higher than 7.6% of all vulnerabilities.
Fix: update to 5.3.59 or later.

Package	Affected versions	Patched versions
calculated fields form codepeople	`< 5.3.59`	`5.3.59`

Description

Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.

References

patchstack.com/database/Wordpress/Plugin/calculated-fields-form/vulnerability/wordpress-calculated-fields-form-5-3-58-cross-site-request-forgery-csrf-vulnerability · Third Party Advisory

More vulnerabilities in calculated fields form

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

calculated fields form

codepeople

< 5.3.59

5.3.59

More vulnerabilities in calculated fields form

See all →