CVE-2023-0165CWE-79

CVE-2023-0165: vulnerability in Cost Calculator

Cost Calculator <= 1.8 - Contributor+ Stored XSS

Published · Updated

Follow this CVE+ Monitor Cost Calculator

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.5%
The Cost Calculator WordPress plugin through 1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected products
Unknown · Cost Calculator
Related CVEs — Cost Calculator

In the same product, most dangerous first.

CVE-2021-24820—Cost Calculator <= 1.6 - Authenticated Local File InclusionEPSS 3.0%CVE-2021-24821—Cost Calculator < 1.6 - Contributor+ Stored Cross-Site ScriptingEPSS 0.6%