CVE-2025-0805: Mlcalc Mortgage Loan Calculator XSS Vulnerability

CVE-2025-0805 Overview

CVE-2025-0805 is a Stored Cross-Site Scripting (XSS) vulnerability in the Mortgage Calculator / Loan Calculator plugin for WordPress. The flaw affects all versions up to and including 1.5.20. It resides in the plugin's mlcalc shortcode, which fails to properly sanitize input and escape output on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected scripts execute in the browser of any user who visits the affected page. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can persist malicious JavaScript into published pages, enabling session theft, redirects, and administrative actions in the context of visitors including site administrators.

Affected Products

Mlcalc Mortgage Loan Calculator plugin for WordPress — all versions ≤ 1.5.20
WordPress sites using the mlcalc shortcode
Any WordPress installation granting contributor-level accounts to untrusted users

Discovery Timeline

2025-02-18 - CVE-2025-0805 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0805

Vulnerability Analysis

The vulnerability originates in the plugin's mlcalc shortcode handler, defined in mlcalc.php around line 62. Shortcode attributes supplied by an authenticated user are rendered into the resulting HTML page without adequate sanitization or contextual output escaping. WordPress shortcodes accept arbitrary key-value attributes, and when those attributes are echoed directly into the DOM, an attacker can break out of the intended attribute context and inject <script> payloads or event handlers.

Because the payload is stored in the post content of the affected page, every visitor to that page triggers execution in their browser session. The scope change reflected in the CVSS vector reflects that scripts execute in the origin context of the WordPress site regardless of the injecting user's role. An attacker holding a contributor account, which is a low-trust role commonly granted to guest writers, can escalate influence to any authenticated visitor including administrators.

Root Cause

The root cause is missing input sanitization and missing output escaping on user-controlled shortcode attributes in the plugin's rendering logic. WordPress provides helpers such as esc_attr(), esc_html(), and wp_kses() that must be applied to any dynamic content emitted into HTML, but these are not used on the mlcalc shortcode attributes. Reference the WordPress Plugin Calculation Script and the WordPress Plugin Forms File for the affected code paths.

Attack Vector

An authenticated attacker with contributor or higher privileges creates or edits a post containing the mlcalc shortcode with malicious attribute values. Once the post is viewed, either as a preview by a reviewer or after publication, the stored payload runs in the visitor's browser. User interaction is required, satisfied by any user navigating to the affected page. See the Wordfence Vulnerability Report for additional detail.

No verified public proof-of-concept code is available. The exploitation pattern follows the standard shortcode attribute injection technique documented for CWE-79 in WordPress plugins.

Detection Methods for CVE-2025-0805

Indicators of Compromise

Posts or pages containing [mlcalc ...] shortcodes with attribute values that include <, >, ", ', javascript:, onerror=, or onload= substrings
Unexpected outbound requests from site visitors to attacker-controlled domains loaded through injected scripts
New or modified posts authored by contributor-level accounts that reference the mlcalc shortcode
Administrator sessions with anomalous actions (user creation, plugin installation) originating shortly after viewing a plugin-rendered page

Detection Strategies

Query the wp_posts table for post content matching the pattern [mlcalc and review attribute values for HTML or JavaScript syntax
Enable a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from plugin-rendered pages
Review web server access logs for POST requests to admin-ajax.php or post.php from contributor accounts that immediately precede publication of pages containing the shortcode
Correlate contributor account activity with subsequent administrator page views to identify potential session hijack chains

Monitoring Recommendations

Monitor changes to posts and pages via the WordPress audit log, focusing on contributor and author role activity
Alert on outbound HTTP requests from browsers that reference newly modified content on the WordPress site
Track plugin version inventory across the WordPress estate to identify hosts still running mortgage-loan-calculator ≤ 1.5.20

How to Mitigate CVE-2025-0805

Immediate Actions Required

Update the Mortgage Calculator / Loan Calculator plugin to the latest available version above 1.5.20 as soon as a patched release is available from the vendor
Audit all existing posts and pages for the mlcalc shortcode and inspect attribute values for injected scripts
Restrict the contributor role to trusted users and review the account roster for stale or unknown accounts
Force a password reset and session invalidation for any account suspected of abuse

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD record. Administrators should monitor the WordPress plugin repository entry for mortgage-loan-calculator and apply any version released above 1.5.20. Confirm the installed version through the WordPress admin plugins screen or via WP-CLI with wp plugin list --name=mortgage-loan-calculator.

Workarounds

Deactivate and remove the plugin if a patched version is not yet available and the shortcode is not business-critical
Deploy a Web Application Firewall (WAF) rule blocking POST requests where the body contains [mlcalc combined with HTML tag characters
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to known origins
Revoke contributor-level access from any account that does not require it and require multi-factor authentication for all editorial roles

bash

# Configuration example: identify affected installations and remove the plugin
wp plugin list --name=mortgage-loan-calculator --fields=name,status,version
wp plugin deactivate mortgage-loan-calculator
wp plugin delete mortgage-loan-calculator

# Search post content for the vulnerable shortcode usage
wp db query "SELECT ID, post_title, post_author FROM wp_posts WHERE post_content LIKE '%[mlcalc%';"