CVE-2021-24821

CVE-2021-24821 affects the WordPress Cost Calculator plugin prior to 1.6. The vulnerability allows users with a role as low as Contributor to perform a Stored Cross-Site Scripting (XSS) via the Description field in Cost Calculator > Price Settings (injected on the edit page and on pages embedd...

CVE-2023-0165

CVE-2023-0165 affects the Cost Calculator WordPress plugin (versions 1.8 and earlier). The vulnerability arises from lack of validation/escaping of shortcode attributes, allowing Stored XSS via shortcodes embedded in posts/pages by users with contributor+ roles. Affected component: shortcode attr...

CVE-2023-1155

CVE-2023-1155 : The Cost Calculator plugin for WordPress (versions up to 1.8) is vulnerable to Stored Cross-Site Scripting via the nd_cc_meta_box_cc_price_icon parameter. Exploitation requires authenticated access at contributor level or higher, and scripts run when a user visits an injected page...