The vulnerability is an improper neutralization of input during web page generation that results in a DOM‑Based Cross Site Scripting (XSS) flaw. An attacker can supply crafted data that is reflected or processed by the browser, allowing the execution of arbitrary JavaScript in the context of the victim’s session. This can lead to session hijacking, defacement, or the execution of phishing attacks, compromising confidentiality, integrity and availability of the affected web application.

The issue affects the WordPress plugin Stylish Cost Calculator, version 8.1.5 and earlier. The plugin is distributed by Design:Stylish Cost Calculator and is used on WordPress sites that incorporate the cost calculator widget.

The vulnerability has a CVSS score of 6.5, indicating a moderate severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is client‑side; a malicious link or page that includes crafted payloads can trigger the XSS on any user who visits the page. No privileged access or server‑side code execution is required for exploitation.