Mortgage Calculator <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mortgage_calculator' Shortcode 'title' Attribute

ID

WPSEC-2026-1423

Plugin

Mortgage Calculator (mortgage-calculator)

Affected

from 1.2.0 before 1.3.1

Remediation

Update to 1.3.1 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness

CWE-79

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22

Attack surface

Mortgage Calculator on WPSec AttackSurface

Fix released

2026-10-21

Published

2026-10-22

Description

The Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute of the 'mortgage_calculator' shortcode in all versions up to, and including, 1.3.0, due to insufficient input sanitization and output escaping on the user-supplied attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

• https://wpsec.com/vuln/WPSEC-2026-1423/
• https://plugins.svn.wordpress.org/mortgage-calculator/tags/1.3.1/
• https://wordpress.org/plugins/mortgage-calculator/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS