The vulnerability is an improper neutralization of input during web page generation that permits stored cross‑site scripting. An attacker can embed arbitrary scripts that are saved within the plugin and subsequently served to other site users, resulting in client‑side code execution and potential compromise of confidentiality or integrity of user data.

The issue affects the Stylemix Cost Calculator Builder WordPress plugin up through version 3.2.65. Any WordPress site that has a vulnerable version of this plugin is at risk.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests the probability of real‑world exploitation is currently low, and the flaw is not listed in the CISA KEV catalog. Stored XSS may not require authentication, but the available data does not specify whether authentication is required, so this condition cannot be confirmed. Once stored, the malicious script will execute in the browsers of subsequent visitors to the affected pages, enabling client‑side code execution.