CVE-2021-24821
Medium
Description
The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page)
SeverityMedium
CVSS5.4
Exploit probability—
ProductNicdark Cost Calculator
PublishedMar 7, 2022
First seenMar 7, 2022
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- nicdark cost_calculator1.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nicdark cost_calculator | v < 1.6 | 1.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.