# Mortgage Calculators WP < 1.64 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings

- **ID:** WPSEC-2026-1862
- **Plugin:** Mortgage Calculators WP (`mortgage-calculators-wp`), https://wordpress.org/plugins/mortgage-calculators-wp/
- **Affected versions:** all versions before 1.64
- **Fixed in:** 1.64 (Update to 1.64 or later.)
- **Severity:** Medium 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mortgage-calculators-wp
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1862/

## Description

The Mortgage Calculators WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings, such as the calculator field labels, starting values, currency symbol and disclaimer, in versions before 1.64. This is due to the settings being saved without sanitization and printed into the calculator without output escaping. This makes it possible for authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts that execute whenever a user views a page containing the calculator. This only affects multi-site installations and installations where unfiltered_html has been disabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1862/
- https://plugins.svn.wordpress.org/mortgage-calculators-wp/tags/1.64/
- https://wordpress.org/plugins/mortgage-calculators-wp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1862/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.