Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · cost-calculator-builder
Cost Calculator Builder
23 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 4, 2026Cost Calculator Builder: Insertion of Sensitive Information Into Sent DataCVE-2026-97307 · affects up to 4.0.17 · reported by PatchstackHigh 7.5
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.
Aug 5, 2026Cost Calculator Builder: Unauthorized access of sensitive dataCVE-2026-7753 · affects up to 3.6.17 · reported by WordfenceMedium 6.5
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculator-custom-export-run` AJAX action (handler `CCBExportImport::export_calculators()`) in all versions up to, and including, 3.6.17. The handler only verifies a nonce, but the corresponding `ccb_export_nonce` is broadcast on every wp-admin page (including pages reachable to Subscribers, such as `/wp-admin/profile.php`) by the `ccb_add_admin_nonces` callback hooked to `admin_head`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export every calculator's full configuration — including stored Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 29, 2026Cost Calculator Builder PRO: Remote Code ExecutionCVE-2026-14900 · affects up to 4.0.3 · reported by WordfenceCritical 9.8
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside js_to_php(), with the regex allow-list in evaluateFormula() only filtering alphanumeric tokens and leaving non-word punctuation characters intact. This makes it possible for unauthenticated attackers to execute code on the server. The only authentication barrier is a nonce check, but the required nonce is publicly emitted on every front-end page via the wp_head hook, making it freely obtainable by unauthenticated visitors. Payloads must be non-word XOR gadgets to bypass sanitization.
Jul 11, 2026Cost Calculator Builder: Sensitive Information ExposureCVE-2026-10865 · affects up to 4.0.11 · reported by WordfenceMedium 5.3
The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 13, 2026Cost Calculator Builder: Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR)CVE-2025-14755 · affects up to 4.0.1 · reported by WordfenceMedium 5.3
The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR) in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator Builder PRO. This is due to the ccb_woocommerce_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the renderWooCommercePayment() function passing user-controlled data directly to CCBWooCheckout::init() without authorization checks. This makes it possible for unauthenticated attackers to add WooCommerce products to their cart with attacker-controlled prices.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 16, 2026Cost Calculator Builder: Unauthenticated Payment Status BypassCVE-2025-14757 · affects up to 3.6.9 · reported by WordfenceMedium 5.3
The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccb_nonces in the page source, any unauthenticated attacker can mark any order's payment status as "completed" without actual payment.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 1, 2025Cost Calculator Builder: Arbitrary file deletionCVE-2025-12529 · affects up to 3.6.3 · reported by WordfenceHigh 8.8
The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() function in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to inject arbitrary file paths into the orders that are removed, when an administrator deletes them. This can lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability requires the Cost Calculator Builder Pro version to be installed along with the free version in order to be exploitable.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 6, 2025Cost Calculator Builder: Missing AuthorizationCVE-2025-62049 · affects up to 3.5.32 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through <= 3.5.32.
Oct 3, 2025Cost Calculator Builder: Unauthorizedmodification of dataCVE-2025-9243 · affects up to 3.5.32 · reported by WordfenceHigh 8.1
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and update_order_status functions in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access order management functions and modify order status.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2025Cost Calculator Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48277 · affects up to 3.2.74 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder allows Stored XSS.This issue affects Cost Calculator Builder: from n/a through <= 3.2.74.
Apr 17, 2025Cost Calculator Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-39587 · affects up to 3.2.65 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder allows SQL Injection.This issue affects Cost Calculator Builder: from n/a through <= 3.2.65.
Apr 11, 2025Cost Calculator Builder: Time-based SQL InjectionCVE-2025-2128 · affects up to 3.2.67 · reported by WordfenceMedium 6.5
The Cost Calculator Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_ids’ parameter in all versions up to, and including, 3.2.67 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 31, 2025Cost Calculator Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31414 · affects up to 3.2.65 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder allows Stored XSS.This issue affects Cost Calculator Builder: from n/a through <= 3.2.65.
Jan 8, 2025Cost Calculator Builder PRO: Blind time-based SQL InjectionCVE-2024-11939 · affects up to 3.2.15 · reported by WordfenceHigh 7.5
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘data’ parameter in all versions up to, and including, 3.2.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Dec 18, 2024Cost Calculator Builder: Does not have CSRF checks in some AJAX actionsCVE-2024-10892 · fixed in 3.2.43 · reported by WPScanMedium 5.4
The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.
Dec 13, 2024Cost Calculator Builder: Missing AuthorizationCVE-2023-40011 · affects up to 3.1.42 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in StylemixThemes Cost Calculator Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator Builder: from n/a through 3.1.42.
Sep 30, 2024Cost Calculator Builder: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2024-8379 · fixed in 3.2.29 · reported by WPScanHigh 7.2
The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
Sep 7, 2024Cost Calculator Builder PRO: Price manipulationCVE-2024-6010 · affects up to 3.2.1 · reported by WordfenceMedium 5.3
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17.
Aug 29, 2024Cost Calculator Builder: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43144 · affects up to 3.2.15 · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Cost Calculator Builder allows SQL Injection.This issue affects Cost Calculator Builder: from n/a through 3.2.15.
Jul 2, 2024Cost Calculator Builder: Unauthorized modification of dataCVE-2024-6012 · affects up to 3.2.12 · reported by WordfenceMedium 4.3
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary posts and append arbitrary content to existing posts.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 2, 2024Cost Calculator Builder: Stored Cross-Site ScriptingCVE-2024-6011 · affects up to 3.2.12 · reported by WordfenceMedium 4.4
The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Jun 19, 2024Cost Calculator Builder PRO: Arbitrary email sending vulnerabilityCVE-2024-4787 · affects up to 3.1.75 · reported by WordfenceMedium 5.8
The Cost Calculator Builder PRO for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 3.1.75. This is due to insufficient limitations on the email recipient and the content in the 'send_pdf' and the 'send_pdf_front' functions which are reachable via AJAX. This makes it possible for unauthenticated attackers to send emails with any content to any recipient.
May 2, 2024Cost Calculator Builder: Stored Cross-Site ScriptingCVE-2024-4097 · affects up to 3.1.67 · reported by WordfenceHigh 7.2
The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 3.1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.