Mortgage Calculators WP < 1.56 – Admin+ Stored Cross-Site Scripting | CVE 2021-24904 | Plugin Vulnerabilities

Description

The plugin does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Proof of Concept

1. Go to settings page available under the "Calculator" menu item.
2. Click the "Select Color" button and type the following payload the input space: </style></head><script>alert(/XSS/)</script>
3. Click the "Save Changes" button to save settings.
4. Create a new page and add the shortcode ([mcwp type="cv"]) of the calculator, for testing.
5. Visit the page to trigger XSS.

Affects Plugins

mortgage-calculators-wp

Fixed in 1.56

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Ceylan Bozogullarindan

Submitter

Ceylan Bozogullarindan

Submitter website

https://bozogullarindan.com

Submitter twitter

Verified

Yes

WPVDB ID

7b80f89b-e724-41c5-aa03-21d1eef50f21

Timeline

Publicly Published

2022-01-11 (about 3 years ago)

Added

2022-01-11 (about 3 years ago)

Last Updated

2022-04-13 (about 3 years ago)

Other

Published

Title

Published

2024-06-14

Title

Stratum – Elementor Widgets < 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget

Published

2025-01-16

Title

EmailPress <= 1.0 - Reflected Cross-Site Scripting

Published

2023-11-08

Title

Elementor Website Builder < 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_inline_svg()

Published

2025-11-20

Title

Bulma Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2014-05-28

Title

Alipay < 3.7.0 'inc.tenpay_notify.php' Cross-Site Scripting (XSS)