CVE-2025-48277: Cost Calculator Builder Stored XSS Vulnerability

CVE-2025-48277 Overview

CVE-2025-48277 is a stored cross-site scripting (XSS) vulnerability in the Stylemix Cost Calculator Builder plugin for WordPress. The flaw affects all versions of cost-calculator-builder up to and including 3.2.74. It stems from improper neutralization of user input during web page generation, classified as [CWE-79]. An authenticated attacker with high-level privileges can inject malicious scripts that persist in the application and execute when other users load the affected pages. The issue was published to the National Vulnerability Database (NVD) on May 19, 2025.

Critical Impact
Stored payloads execute in the browser context of any user viewing affected pages, enabling session theft, administrative action hijacking, and cross-scope compromise through the changed security scope.

Affected Products

Stylemix Cost Calculator Builder WordPress plugin (cost-calculator-builder)
All versions from initial release through 3.2.74
WordPress sites using vulnerable versions of the plugin

Discovery Timeline

2025-05-19 - CVE-2025-48277 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48277

Vulnerability Analysis

The vulnerability lets a privileged attacker persist attacker-controlled markup or JavaScript within the plugin's stored configuration data. When administrators or other authorized users view the calculator interface, the browser renders the injected payload as active content. The Patchstack advisory categorizes the issue as stored XSS reachable through the plugin's builder inputs.

Successful exploitation requires an authenticated session and user interaction to trigger. Because the affected security scope changes on payload execution, script actions can extend beyond the vulnerable plugin surface into the wider WordPress admin experience. The Exploit Prediction Scoring System (EPSS) currently places this issue in the lower tier of near-term exploitation likelihood, and no public proof-of-concept is available.

Root Cause

Input accepted through the Cost Calculator Builder interface is stored without adequate sanitization and later reflected into the DOM without proper output encoding. WordPress provides helpers such as wp_kses_post, esc_html, and esc_attr for context-aware escaping, but the plugin fails to consistently apply them across the affected fields before rendering.

Attack Vector

Exploitation proceeds over the network against the WordPress administrative interface. An attacker with high privileges submits a crafted payload through the Cost Calculator Builder configuration. The payload is stored server-side and executes when another authenticated user loads a page that renders the injected content. Refer to the Patchstack XSS Vulnerability Advisory for advisory details.

No verified proof-of-concept code is published. The vulnerability mechanism follows the standard stored XSS pattern: persist an unescaped script payload in a plugin data store, then rely on a victim's browser to render it in an authenticated context.

Detection Methods for CVE-2025-48277

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (for example onerror, onload) inside stored Cost Calculator Builder configuration fields.
Administrative sessions that generate outbound requests to unfamiliar domains shortly after loading calculator pages.
New WordPress administrator accounts, plugin installations, or option changes made without corresponding audit-trail justification.

Detection Strategies

Query the WordPress database for plugin option rows and post meta associated with cost-calculator-builder and flag entries containing HTML tags or JavaScript URI schemes.
Deploy content security policy (CSP) reporting to surface script executions from unexpected sources on wp-admin pages.
Correlate authenticated admin activity with browser-initiated requests to non-approved endpoints using web proxy or endpoint telemetry.

Monitoring Recommendations

Monitor WordPress plugin update status and alert when installations remain on cost-calculator-builder versions at or below 3.2.74.
Track privileged user activity in wp-admin, specifically edits to calculator entities and subsequent admin session behavior.
Log and review outbound HTTP requests originating from admin browser sessions for signs of session token exfiltration.

How to Mitigate CVE-2025-48277

Immediate Actions Required

Update Stylemix Cost Calculator Builder to a version later than 3.2.74 as soon as a fixed release is published by the vendor.
Audit existing calculator configurations for injected markup and remove any unauthorized script content.
Rotate credentials and session cookies for administrator accounts that may have interacted with tampered calculator pages.

Patch Information

Refer to the Patchstack XSS Vulnerability Advisory for current patch status and vendor guidance. Verify the installed plugin version through the WordPress admin dashboard under Plugins and apply the vendor-supplied fix once available.

Workarounds

Restrict access to the Cost Calculator Builder configuration to a minimal set of trusted administrators until a patched version is deployed.
Deploy a web application firewall (WAF) rule set that inspects and blocks script tags and JavaScript event handlers submitted to plugin endpoints.
Enforce a strict Content Security Policy on wp-admin to limit inline script execution and constrain script sources.
Temporarily deactivate the plugin on high-value WordPress instances if administrative exposure cannot be constrained.

bash

# Configuration example: check installed plugin version via WP-CLI
wp plugin get cost-calculator-builder --field=version

# Deactivate the plugin as a temporary mitigation
wp plugin deactivate cost-calculator-builder