{
 "id": "WPSEC-2026-1862",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1862/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1862/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1862/index.md",
 "title": "Mortgage Calculators WP < 1.64 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings",
 "description": "The Mortgage Calculators WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings, such as the calculator field labels, starting values, currency symbol and disclaimer, in versions before 1.64. This is due to the settings being saved without sanitization and printed into the calculator without output escaping. This makes it possible for authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts that execute whenever a user views a page containing the calculator. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
 "plugin": {
  "slug": "mortgage-calculators-wp",
  "name": "Mortgage Calculators WP",
  "full_name": "Mortgage Calculators WP",
  "wordpress_org": "https://wordpress.org/plugins/mortgage-calculators-wp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mortgage-calculators-wp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mortgage-calculators-wp"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.64",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.64"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.64",
 "remediation": "Update to 1.64 or later.",
 "fix_released": "2026-10-27T17:35:19+00:00",
 "published": "2026-10-28T17:42:28+00:00",
 "updated": "2026-10-28T09:34:21.896265+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1862/",
  "https://plugins.svn.wordpress.org/mortgage-calculators-wp/tags/1.64/",
  "https://wordpress.org/plugins/mortgage-calculators-wp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mortgage-calculators-wp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-28"
 }
}