CVE-2025-54046 Overview
CVE-2025-54046 is a stored cross-site scripting (XSS) vulnerability in the QuanticaLabs Cost Calculator plugin for WordPress (ql-cost-calculator). The flaw stems from improper neutralization of input during web page generation [CWE-79]. Authenticated attackers with low privileges can inject persistent JavaScript payloads that execute in the browsers of users who view affected pages. The issue affects all Cost Calculator versions up to and including 7.4. The vulnerability carries a CVSS 3.1 base score of 6.5 and requires user interaction to trigger the payload. Successful exploitation impacts confidentiality, integrity, and availability with a scope change, meaning the injected script can affect resources beyond the vulnerable component.
Critical Impact
Authenticated attackers can store malicious scripts that execute in victim browsers, enabling session theft, account takeover, and administrative action hijacking within WordPress sites running the plugin.
Affected Products
- QuanticaLabs Cost Calculator (ql-cost-calculator) WordPress plugin
- All versions from initial release through 7.4
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2025-08-20 - CVE-2025-54046 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54046
Vulnerability Analysis
The Cost Calculator plugin fails to properly sanitize and encode user-supplied input before rendering it within HTML output. This classification aligns with [CWE-79], Improper Neutralization of Input During Web Page Generation. Because the payload is persisted server-side, any visitor who loads a page containing the affected calculator content triggers script execution automatically.
Attackers can leverage stored XSS to hijack administrator sessions, exfiltrate cookies, perform actions on behalf of the victim, or pivot to further compromise the WordPress installation. The scope change indicated by the CVSS vector reflects that scripts executing in the browser can affect security contexts beyond the plugin, including the WordPress admin interface.
Root Cause
The root cause is missing or insufficient output encoding on input fields exposed to authenticated contributor-level or higher users. Input accepted through plugin configuration or content-generation flows is stored in the database and later rendered without proper escaping via WordPress functions such as esc_html(), esc_attr(), or wp_kses().
Attack Vector
Exploitation requires network access, low privileges on the WordPress site, and user interaction to view the injected content. An authenticated attacker submits crafted input containing HTML or JavaScript through a plugin field that is later rendered on a public or administrative page. When another user, typically an administrator, loads the page, the browser executes the stored payload under the site's origin.
See the Patchstack XSS Vulnerability Report for additional technical detail.
Detection Methods for CVE-2025-54046
Indicators of Compromise
- Unexpected <script>, onerror, onload, or javascript: strings stored in wp_postmeta or plugin-specific option tables associated with ql-cost-calculator.
- Outbound requests from administrator browsers to unfamiliar domains shortly after visiting pages containing the calculator.
- New or modified WordPress administrator accounts created without a corresponding legitimate audit trail.
Detection Strategies
- Audit plugin database entries for HTML tags, event handlers, and encoded JavaScript payloads within Cost Calculator configuration fields.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from plugin-rendered content.
- Review WordPress access logs for POST requests to plugin admin endpoints from low-privilege accounts followed by administrator page loads.
Monitoring Recommendations
- Enable WordPress audit logging to capture content changes made by contributor, author, and editor roles.
- Monitor DOM-level anomalies and script execution on admin pages using browser-side telemetry or web application firewall (WAF) inspection.
- Alert on installations of the ql-cost-calculator plugin at versions 7.4 or earlier across managed sites.
How to Mitigate CVE-2025-54046
Immediate Actions Required
- Identify all WordPress sites running QuanticaLabs Cost Calculator version 7.4 or earlier and prioritize patching.
- Restrict plugin configuration and content-authoring privileges to trusted accounts until a fix is applied.
- Review existing plugin content and database entries for injected scripts and remove any malicious payloads.
Patch Information
At the time of publication, no fixed version is listed in the enriched CVE data beyond the affected range through 7.4. Consult the Patchstack advisory and the QuanticaLabs vendor page for the latest patched release and update guidance.
Workarounds
- Deactivate and remove the Cost Calculator plugin until a patched version is confirmed available.
- Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources on WordPress admin and public pages.
- Deploy a WAF ruleset that inspects and blocks XSS patterns targeting plugin endpoints, and limit contributor-level accounts to vetted users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
