The EM Cost Calculator WordPress plugin stores the 'customer_name' field without escaping, which allows an unauthenticated user to inject malicious JavaScript that is later rendered in the admin customer list. The stored cross‑site scripting permits the attacker to execute arbitrary code in the context of any administrator who views the affected page, potentially leading to session hijacking, defacement, or data exfiltration.

The vulnerability affects the EM Cost Calculator plugin by the vendor motahar1, versions 2.3.1 and earlier, which runs on WordPress sites.

The CVSS score assigned to this flaw is 6.1, reflecting a moderate severity with potential for abuse. The EPSS score is below 1 %, indicating a low probability of exploitation at the moment, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can exploit the flaw without authentication by submitting malicious input via the customer name field, and when an administrator later accesses the customer list page the stored script runs in their browser. Given the lack of control requirements and the relatively low exploitation probability, the risk remains moderate but should not be ignored.