CVE-2021-24821: Cost Calculator < 1.6 - Contributor+ Stored Cross-Site Scripting
The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page)
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for the Cost Calculator WordPress plugin?
The vulnerability ID for the Cost Calculator WordPress plugin is CVE-2021-24821.
What is the severity of CVE-2021-24821?
The severity of CVE-2021-24821 is medium, with a CVSS score of 5.4.
How does CVE-2021-24821 allow Stored Cross-Site Scripting attacks?
CVE-2021-24821 allows Stored Cross-Site Scripting attacks through the Description fields of a Cost Calculator > Price Settings in the affected plugin.
Which version of the Cost Calculator WordPress plugin is affected by CVE-2021-24821?
The Cost Calculator WordPress plugin version 1.6 is affected by CVE-2021-24821.
Where can I find more information about CVE-2021-24821?
You can find more information about CVE-2021-24821 at the following reference link: https://wpscan.com/vulnerability/f0915b66-0b99-4aeb-9fba-759cafaeb0cb