CVE-2024-6011mediumCWE-79

CVE-2024-6011: medium-severity vulnerability in stylemix Cost Calculator Builder

Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.4epss 0.4%
exploitation probability
0.4%top 64% of all CVEs
observed exploitation
nono source reports it
The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Affected products
stylemix · Cost Calculator Builder
Related CVEs — stylemix Cost Calculator Builder

In the same product, most dangerous first.

CVE-2026-10865MEDIUMCost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret KeysEPSS 0.6%CVE-2025-12529HIGHCost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File DeletionEPSS 0.5%CVE-2026-7753MEDIUMCost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information DisclosureEPSS 0.5%CVE-2025-2128MEDIUMCost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids ParameterEPSS 0.4%CVE-2024-6012MEDIUMCost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content CreationEPSS 0.4%CVE-2025-14757MEDIUMCost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status BypassEPSS 0.4%
References
https://drive.google.com/file/d/1SFQXlRUQw7THm_Vay_pFH3pIX1cjH4AY/view?usp=sharinghttps://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/templates/frontend/fields/cost-text.php#L15https://plugins.trac.wordpress.org/browser/cost-calculator-builder/trunk/templates/frontend/fields/cost-text.php#L26https://plugins.trac.wordpress.org/changeset/3108606/https://www.wordfence.com/threat-intel/vulnerabilities/id/03ad3677-1b02-4f22-af50-e88b2ec83f54?source=cve