Medium severity5.4NVD Advisory· Published Mar 7, 2022· Updated Jun 17, 2026

CVE-2021-24821

Description

The Cost Calculator WordPress plugin before 1.6 allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the Description fields of a Cost Calculator > Price Settings (which gets injected on the edit page as well as any page that embeds the calculator using the shortcode), as well as the Text Preview field of a Project (injected on the edit project page)

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nicdark/Cost Calculator
cpe:2.3:a:nicdark:cost_calculator:*:*:*:*:*:wordpress:*:*
Range: <1.6
WordPress/Cost Calculator WordPress plugindescription
WordPress/Cost Calculatorllm-fuzzy
Range: <1.6

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/f0915b66-0b99-4aeb-9fba-759cafaeb0cbnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000