CVE-2026-2506

EUVD-2026-8810
The EM Cost Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to the plugin storing attacker-controlled 'customer_name' data and rendering it in the admin customer list without output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the EMCC Customers page.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WordfenceCNA
6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://plugins.trac.wordpress.org/browser/cost-calculator/tags/2.3.1/em-cost-calc-admin-page.php#L59
https://plugins.trac.wordpress.org/browser/cost-calculator/tags/2.3.1/em-cost-calculator-widget.php#L655
https://plugins.trac.wordpress.org/browser/cost-calculator/tags/2.3.1/em-cost-calculator-widget.php#L682
https://plugins.trac.wordpress.org/browser/cost-calculator/tags/2.3.1/em-cost-calculator-widget.php#L701
https://www.wordfence.com/threat-intel/vulnerabilities/id/1eef338a-ccc7-41a2-b87a-0945e39380d2?source=cve