Stylish Cost Calculator < 7.04 - Subscriber+ Unauthorised AJAX Calls to Stored XSS

published 2021-11-29 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-11734

cvss: 5.4; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits: 0; none known

The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters

Patch / fix

fixed in 1

stylishcostcalculator stylish_cost_calculator 7.0.4

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

wpscan.com https://wpscan.com/vulnerability/db84a782-d4c8-4abf-99ea-ea672a9b806e referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD	2.0	3.5	AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

Unknown Stylish Cost Calculator

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-352 Cross-Site Request Forgery

Technology feeds

WordPress rss critical rss

References

wpscan.com /vulnerability/db84a782-d4c8-4abf-99ea-ea672a9b806e
exploit, third-party-advisory

Sources

CVE List CVE-2021-24822
NVD CVE-2021-24822

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary