title: Cost Calculator < 1.6 - Contributor+ Stored Cross-Site Scripting
description: The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page)
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Cost Calculator
vendor: Unknown
versions:
lessThan: 1.6, status: affected, version: 1.6, versionType: custom
}