Improper neutralization of input during web page generation allows Stored XSS in the Stylemix Cost Calculator Builder plugin. This flaw permits an attacker to embed malicious scripts into stored data that are later rendered on a page, causing the script to execute in the browsers of any user who views the affected page. The weakness is identified as CWE‑79.

The vulnerability affects the WordPress plugin Cost Calculator Builder by Stylemix. All releases up to and including version 3.2.74 are vulnerable. The plugin is typically installed within a WordPress site environment where user‑supplied data is displayed.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The issue is not catalogued in the CISA KEV list. Exploitation requires an attacker to have permission to create or modify calculator entries so that malicious input can be stored; once stored, the script executes in the browser of any user who loads the page containing the entry.