CVE-2026-24630

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24630", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-23T12:32:36.810Z", "datePublished": "2026-01-23T14:29:08.236Z", "dateUpdated": "2026-04-28T16:14:50.686Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "stylish-cost-calculator", "product": "Stylish Cost Calculator", "vendor": "Design", "versions": [{"lessThanOrEqual": "8.2.9", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "zaim | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:49.019Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows Stored XSS.<p>This issue affects Stylish Cost Calculator: from n/a through <= 8.2.9.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows Stored XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.2.9."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "Stored XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:50.686Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/stylish-cost-calculator/vulnerability/wordpress-stylish-cost-calculator-plugin-8-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "title": "WordPress Stylish Cost Calculator plugin <= 8.2.9 - Cross Site Scripting (XSS) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T17:02:30.634628Z", "id": "CVE-2026-24630", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:45:20.703Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24630", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T17:02:30.634628Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T17:02:28.185Z"}}], "cna": {"title": "WordPress Stylish Cost Calculator plugin <= 8.2.9 - Cross Site Scripting (XSS) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "zaim | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "Stored XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Design", "product": "Stylish Cost Calculator", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.2.9"}], "packageName": "stylish-cost-calculator", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:49.019Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/stylish-cost-calculator/vulnerability/wordpress-stylish-cost-calculator-plugin-8-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows Stored XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.2.9.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows Stored XSS.<p>This issue affects Stylish Cost Calculator: from n/a through <= 8.2.9.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:07.136Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24630", "state": "PUBLISHED", "dateUpdated": "2026-04-28T14:45:20.703Z", "dateReserved": "2026-01-23T12:32:36.810Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-23T14:29:08.236Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "stylish-cost-calculator", "product": "Stylish Cost Calculator", "vendor": "Design", "versions": [{"lessThanOrEqual": "8.2.9", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows Stored XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.2.9."}, {"lang": "es", "value": "Neutralizaci\u00f3n Incorrecta de la Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web ('cross-site scripting') en Design Stylish Cost Calculator stylish-cost-calculator permite XSS Almacenado. Este problema afecta a Stylish Cost Calculator: desde n/a hasta &lt;= 8.1.8."}], "id": "CVE-2026-24630", "lastModified": "2026-06-17T10:23:21.047", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 3.7, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24630", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T17:02:30.634628Z", "version": "2.0.3"}}]}, "published": "2026-01-23T15:16:22.387", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/stylish-cost-calculator/vulnerability/wordpress-stylish-cost-calculator-plugin-8-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T17:47:54.923869+00:00", "value": {"mitigation_remediation": ["Upgrade the Stylish Cost Calculator plugin to the latest available version, which removes the vulnerability.", "If an upgrade is not immediately possible, disable or remove the plugin, or, at a minimum, restrict access to the pages that allow user\u2011submitted content so that the stored XSS payload is not rendered to visitors.", "Apply output encoding to any user\u2011supplied data that the plugin renders, ensuring that all strings are properly escaped before insertion into HTML.", "Deploy a Content Security Policy that blocks the execution of inline scripts or restricts script sources to trusted domains, reducing the impact of any residual XSS payloads."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress plugin known as Stylish Cost Calculator, developed by Design. Any installation of the plugin up to and including version 8.2.9 is vulnerable. The affected\u2011version range is specified as \"from n/a through <= 8.2.9\" in the vendor\u2019s documentation. No official quick\u2011fix statement is given, but upgrading to a patched version is recommended.", "description_and_impact": "Based on the updated description, the plugin contains an improper neutralization of input during web page generation that permits stored cross\u2011site scripting. An attacker who can submit crafted input through the plugin can have that input rendered in a page viewed by other visitors, allowing the attacker to execute arbitrary JavaScript in their browsers. This flaw is categorized as CWE\u201179.", "risk_and_exploitability": "CVSS score 6.5 indicates a medium severity. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation in the wild at the time of this analysis. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector requires the ability to submit user\u2011controlled content through the plugin interface; thus an attacker would need access to the administrative or user interface that allows cost\u2011calculation entries. Once the malicious content is stored, it is served to all visitors of the affected page, resulting in the execution of the attacker\u2019s JavaScript. Because the flaw does not require privilege escalation or network\u2011level privileges, the attack surface is significant for publicly accessible sites that use the plugin."}}}}, "created": "2026-01-26T11:53:02.930649+00:00", "updated": "2026-04-28T18:00:14.066926+00:00", "vendors": ["design", "design$PRODUCT$stylish_cost_calculator", "wordpress", "wordpress$PRODUCT$wordpress"]}