Vulnerability found in Calculated Fields Form

The Calculated Fields Form plugin for WordPress is not secure and can be exploited by attackers who have administrator-level permissions or higher. The vulnerability allows attackers to inject malicious web scripts into pages, which will be executed when a user accesses an injected page. This exploit only affects multi-site installations or installations where the “unfiltered_html” feature has been disabled. The vulnerability affects all versions of the plugin up to and including version 1.2.40.