Threat Entry Updated 2026-04-15

CVE-2026-2506 - Cost Calculator Plugin

The EM Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to the plugin storing attacker-controlled 'customer_name' data and rendering it in the admin customer list without output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the EMCC Customers page.

PLUGIN Cost Calculator

CVE-2026-2506

MEDIUM CVSS 6.1 2026-02-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-03-06

CVE-2023-0165 - Cost Calculator Plugin

The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

PLUGIN Cost Calculator

CVE-2023-0165

MEDIUM CVSS 5.4 2023-03-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2023-1155 - Cost Calculator Plugin

The Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Cost Calculator

CVE-2023-1155

MEDIUM CVSS 6.4 2023-03-02

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24821 - Cost Calculator Plugin

The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page)

PLUGIN Cost Calculator

CVE-2021-24821

MEDIUM CVSS 5.4 2022-03-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2021-24820 - Cost Calculator Plugin

The Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions

PLUGIN Cost Calculator

CVE-2021-24820

MEDIUM CVSS 6.5 2022-02-28

Risk Score

Open Full Technical Breakdown