CVE-2025-26907: Estatik Mortgage Calculator XSS Flaw

CVE-2025-26907 Overview

CVE-2025-26907 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Estatik Mortgage Calculator WordPress plugin. The flaw exists in versions up to and including 2.0.12. The plugin fails to properly neutralize user-supplied input during web page generation, allowing authenticated attackers with low privileges to inject persistent malicious scripts. Stored payloads execute in the browsers of users who view affected pages, enabling session theft, administrative account takeover, and arbitrary actions within the WordPress context. The weakness is classified under CWE-79.

Critical Impact
Authenticated attackers can inject persistent JavaScript that executes against site administrators and visitors, leading to account takeover and full site compromise.

Affected Products

Estatik Mortgage Calculator WordPress plugin versions through 2.0.12
WordPress sites using the estatik-mortgage-calculator plugin
Any WordPress installation where the plugin is active and accessible to contributor-level or higher users

Discovery Timeline

2025-02-25 - CVE-2025-26907 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26907

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Estatik Mortgage Calculator plugin. The plugin accepts input through one or more configuration or content fields and writes that input back to rendered pages without adequate output encoding or input sanitization. Because the payload is stored in the WordPress database, it executes every time an affected page renders in a browser.

Stored XSS in a WordPress plugin context typically enables attackers to hijack administrator sessions, create rogue admin accounts, modify plugin or theme files, and pivot to remote code execution through the WordPress dashboard. Exploitation requires low privileges on the target site, and the resulting payload affects any user who loads the compromised page.

Root Cause

The root cause is improper neutralization of input during web page generation, as defined by CWE-79. The plugin does not apply WordPress sanitization helpers such as sanitize_text_field() on input or escaping functions such as esc_html(), esc_attr(), or wp_kses() on output. As a result, HTML and JavaScript supplied by authenticated users persist verbatim in the page DOM.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. An attacker submits a crafted payload through a vulnerable input field exposed by the plugin. The malicious script is stored in the database and later rendered in any context that displays the affected field. When an administrator or other visitor loads the page, the script executes with that user's privileges. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-26907

Indicators of Compromise

Presence of <script> tags, javascript: URIs, or event handlers such as onerror= and onload= within Estatik Mortgage Calculator configuration or content stored in wp_options and wp_postmeta tables
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing pages containing the plugin
Creation of new WordPress administrator accounts or modification of user roles without legitimate change history
Modifications to plugin or theme files originating from authenticated admin sessions

Detection Strategies

Audit the estatik-mortgage-calculator plugin version across all WordPress installations and flag any instance running 2.0.12 or earlier
Query the WordPress database for stored values associated with the plugin containing HTML tags or JavaScript event handlers
Inspect web server access logs for POST requests to plugin endpoints containing encoded script payloads such as %3Cscript%3E or onerror%3D
Review browser Content Security Policy (CSP) violation reports for inline script executions on pages that embed the mortgage calculator

Monitoring Recommendations

Monitor WordPress audit logs for changes to plugin settings made by contributor, author, or editor accounts
Alert on creation of administrator accounts and unexpected role elevations
Track outbound HTTP requests from sessions that load pages containing the plugin shortcode
Enable file integrity monitoring on wp-content/plugins/estatik-mortgage-calculator/ and core WordPress directories

How to Mitigate CVE-2025-26907

Immediate Actions Required

Identify all WordPress sites running the Estatik Mortgage Calculator plugin at version 2.0.12 or earlier
Deactivate and remove the plugin until a patched version is confirmed available from the vendor
Rotate WordPress administrator credentials and invalidate active sessions on potentially affected sites
Review user accounts and remove any unauthorized administrators or recently elevated roles

Patch Information

At the time of NVD publication, the advisory lists affected versions through 2.0.12 with no fixed version explicitly identified. Monitor the Patchstack advisory and the official plugin page on the WordPress.org plugin directory for vendor updates. Apply the fixed release as soon as it becomes available.

Workarounds

Restrict access to the plugin's input fields to trusted administrator accounts only and revoke unnecessary contributor or author privileges
Deploy a web application firewall (WAF) rule that blocks requests containing <script> tags or JavaScript event handler patterns targeting plugin endpoints
Implement a strict Content Security Policy that disallows inline scripts on pages rendering the mortgage calculator
Disable the plugin entirely on production sites until a patched version is verified

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate estatik-mortgage-calculator
wp plugin delete estatik-mortgage-calculator

# Verify removal
wp plugin list | grep estatik