Stylish Cost Calculator Vulnerabilities

The Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 8.3.9

Fixed in:

8.3.10

Disclosed:

Jun 18, 2026

CVE-2026-54847 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows Stored XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.1.8.

Affected:

up to 8.1.8

Fix:

No patched version reported

Disclosed:

Jan 23, 2026

CVE-2026-24630 on NVD →

The Stylish Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and excluding, 8.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts i...

CVSS:

6.4

Affected:

up to 8.3.1

Fixed in:

8.3.1

Disclosed:

Jan 9, 2026

CVE-2026-24630 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows DOM-Based XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.1.5.

Affected:

up to 8.1.5

Fix:

No patched version reported

Disclosed:

Nov 21, 2025

CVE-2025-66091 on NVD →

The Stylish Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 8.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts i...

CVSS:

6.4

Affected:

up to 8.1.5

Fixed in:

8.1.6

Disclosed:

Nov 14, 2025

CVE-2025-66091 on NVD →

The Appsero analytics tool used in several plugins is vulnerable to authorization bypass due to a missing capability check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level permissio...

CVSS:

4.3

Affected:

up to 7.3.6

Fixed in:

7.3.7

Disclosed:

Dec 16, 2022

The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function inten...

CVSS:

4.3

Affected:

up to 7.3.6

Fixed in:

7.3.7

Disclosed:

Dec 14, 2022

CVE-2022-47150 on NVD →

[en] The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in adm...

Affected:

up to 7.0.4

Fixed in:

7.0.4

Disclosed:

Nov 29, 2021

CVE-2021-24822 on NVD →

The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, a...

CVSS:

5.4

Affected:

up to 7.0.3

Fixed in:

7.0.4

Disclosed:

Nov 1, 2021

CVE-2021-24822 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 7.3.7

Fixed in:

7.3.7

CVE-2022-47150 on NVD →