CVE-2026-97307
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Cost Calculator Builder plugin up to version 4.0.17 contains a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data.
Risk Assessment
The organization is at risk of leaking sensitive data such as customer information or configuration, which could compromise privacy and trust.
Recommendation
It is recommended to update the Cost Calculator Builder plugin to the latest version that eliminates the sensitive information disclosure vulnerability.
Other vulnerabilities in Cost Calculator Builder
See all- CVE-2026-7753Medium
The Cost Calculator Builder plugin for WordPress up to version 3.6.17 is vulnerable to unauthorized access to sensitive data due to a missing capability check in the AJAX action `cost-calculator-custom-export-run`. The handler only verifies a nonce, which is available on every wp-admin page, allowing authenticated attackers with Subscriber-level access to export full calculator configurations, including Stripe, PayPal, Razorpay, webhook, and reCAPTCHA secret keys.
- CVE-2026-10865Medium
The Cost Calculator Builder plugin for WordPress up to version 4.0.11 exposes sensitive payment gateway credentials (Stripe, Razorpay, PayPal) in the page source. An unauthenticated attacker can extract these credentials when the 'use in all calculators' option is enabled for at least one payment gateway.
- CVE-2025-14755Medium
The Cost Calculator Builder plugin for WordPress (up to version 4.0.1) when used with the PRO version is vulnerable to unauthenticated price manipulation and Insecure Direct Object Reference (IDOR). An unauthenticated attacker can add WooCommerce products to the cart with attacker-controlled prices.
- CVE-2025-62049Medium
The Cost Calculator Builder plugin (Stylemix) up to version 3.5.32 has a Missing Authorization vulnerability. This means unauthorized users may gain access to functions that should be protected.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS