Unknown Cost Calculator vulnerabilities
3 vulnerabilities
Known vulnerabilities in Unknown Cost Calculator, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2021-24821nicdark · cost_calculator +2 moreCost Calculator < 1.6 - Contributor+ Stored Cross-Site ScriptingThe Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page)EPSS0.60%HighCVE-2021-24820bold-themes · cost_calculator +2 moreCost Calculator <= 1.6 - Authenticated Local File InclusionThe Cost Calculator WordPress plugin through 1.6 allows authenticated users (Contributor+ in versions < 1.5, and Admin+ in versions <= 1.6) to perform path traversal and local PHP file inclusion on Windows Web Servers via the Cost Calculator post's LayoutEPSS3.05%MediumCVE-2023-0165nicdark · cost_calculator +2 moreCost Calculator <= 1.8 - Contributor+ Stored XSSThe Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.EPSS0.47%