Based on the updated description, the plugin contains an improper neutralization of input during web page generation that permits stored cross‑site scripting. An attacker who can submit crafted input through the plugin can have that input rendered in a page viewed by other visitors, allowing the attacker to execute arbitrary JavaScript in their browsers. This flaw is categorized as CWE‑79.

The vulnerability affects the WordPress plugin known as Stylish Cost Calculator, developed by Design. Any installation of the plugin up to and including version 8.2.9 is vulnerable. The affected‑version range is specified as "from n/a through <= 8.2.9" in the vendor’s documentation. No official quick‑fix statement is given, but upgrading to a patched version is recommended.

CVSS score 6.5 indicates a medium severity. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation in the wild at the time of this analysis. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector requires the ability to submit user‑controlled content through the plugin interface; thus an attacker would need access to the administrative or user interface that allows cost‑calculation entries. Once the malicious content is stored, it is served to all visitors of the affected page, resulting in the execution of the attacker’s JavaScript. Because the flaw does not require privilege escalation or network‑level privileges, the attack surface is significant for publicly accessible sites that use the plugin.