Plugin icon

Cost Calculator Builder

cost-calculator-builder

Vulnerabilities:

15

Last Updated:

May 14, 2026

Active Installs:

30000

Published
Title
Fixed in
CVSS
Published
2026-05-12
Title
Cost Calculator Builder < 4.0.2 - Unauthenticated Price Manipulation and Insecure Direct Object Reference
Fixed in
Fixed in 4.0.2
CVSS
5.3 (medium)
Published
2026-01-15
Title
Cost Calculator Builder < 3.6.10 - Missing Authorization to Unauthenticated Payment Status Bypass
Fixed in
Fixed in 3.6.10
CVSS
5.3 (medium)
Published
2025-12-01
Title
Cost Calculator Builder < 3.6.4 - Unauthenticated Arbitrary File Deletion
Fixed in
Fixed in 3.6.4
CVSS
8.8 (high)
Published
2025-10-15
Title
Cost Calculator Builder < 3.5.33 - Missing Authorization
Fixed in
Fixed in 3.5.33
CVSS
5.3 (medium)
Published
2025-10-03
Title
Cost Calculator Builder < 3.5.33 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions
Fixed in
Fixed in 3.5.33
CVSS
8.1 (high)
Published
2025-05-19
Title
Cost Calculator Builder < 3.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.5.0
CVSS
4.4 (medium)
Published
2025-04-16
Title
Cost Calculator Builder < 3.2.68 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.2.68
CVSS
7.5 (high)
Published
2025-04-10
Title
Cost Calculator Builder < 3.2.68 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter
Fixed in
Fixed in 3.2.68
CVSS
6.5 (medium)
Published
2025-03-29
Title
Cost Calculator Builder < 3.2.66 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.2.66
CVSS
6.4 (medium)
Published
2024-11-27
Title
Cost Calculator Builder < 3.2.43 - Settings update via CSRF
Fixed in
Fixed in 3.2.43
CVSS
4.3 (medium)
Published
2024-09-09
Title
Cost Calculator Builder < 3.2.29 - Admin+ SQL Injection
Fixed in
Fixed in 3.2.29
CVSS
4.1 (medium)
Published
2024-08-07
Title
Cost Calculator Builder < 3.2.16 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.2.16
CVSS
10 (critical)
Published
2024-07-01
Title
Cost Calculator Builder < 3.2.13 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.2.13
CVSS
4.4 (medium)
Published
2024-07-01
Title
Cost Calculator Builder < 3.2.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation
Fixed in
Fixed in 3.2.13
CVSS
4.3 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.3.3
CVSS
6.1 (medium)