HomeWordPress vulnerabilitiesCost Calculator Builder
Cost Calculator Builder vulnerabilities
Cost Calculator Builder has 14 known vulnerabilities in this database. The most recent published record is dated 4 Oct 2026.
- Known vulnerabilities
- 14
- Active installs
- 20,000+
- Latest version
- 4.0.18
- Last updated
- 29 Sep 2026
- Most recent
- 4 Oct 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Sensitive data exposure CVE-2026-97307 | High 7.5 | Up to 4.0.17 | Fixed in a later version (latest 4.0.18) | 3 d ago |
| Broken access control CVE-2026-7753 | Medium 6.5 | Up to 3.6.17 | Fixed in a later version (latest 4.0.18) | 5 Aug 2026 |
| Sensitive data exposure CVE-2026-10865 | Medium 5.3 | Up to 4.0.11 | Fixed in a later version (latest 4.0.18) | 11 Jul 2026 |
| Broken access control CVE-2025-14755 | Medium 5.3 | Up to 4.0.1 | Fixed in a later version (latest 4.0.18) | 13 May 2026 |
| Broken access control CVE-2025-14757 | Medium 5.3 | Before 3.6.10 | Fixed in 3.6.10 | 16 Jan 2026 |
| Remote code execution CVE-2025-12529 | High 8.8 | Up to 3.6.3 | Fixed in a later version (latest 4.0.18) | 2 Dec 2025 |
| Broken access control CVE-2025-9243 | High 8.1 | Up to 3.5.32 | Fixed in a later version (latest 4.0.18) | 4 Oct 2025 |
| SQL injection CVE-2025-2128 | Medium 6.5 | Up to 3.2.67 | Fixed in a later version (latest 4.0.18) | 11 Apr 2025 |
| Cross-site request forgery (CSRF) CVE-2024-10892 | Medium 5.4 | Before 3.2.43 | Fixed in 3.2.43 | 18 Dec 2024 |
| SQL injection CVE-2024-8379 | High 7.2 | Before 3.2.29 | Fixed in 3.2.29 | 30 Sep 2024 |
| Security weakness CVE-2024-6010 | Medium 5.3 | Up to 3.1.96 | Fixed in a later version (latest 4.0.18) | 7 Sep 2024 |
| Cross-site scripting (XSS) CVE-2024-6011 | Medium 4.4 | Before 3.2.13 | Fixed in 3.2.13 | 2 Jul 2024 |
| Broken access control CVE-2024-6012 | Medium 4.3 | Before 3.2.13 | Fixed in 3.2.13 | 2 Jul 2024 |
| Cross-site scripting (XSS) CVE-2024-4097 | High 7.2 | Up to 3.1.67 | Fixed in a later version (latest 4.0.18) | 2 May 2024 |
Read the published descriptions
- CVE-2026-97307, 4 Oct 2026
- Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17. CVE record
- CVE-2026-7753, 5 Aug 2026
- The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculator-custom-export-run` AJAX action (handler `CCBExportImport::export_calculators()`) in all versions up to, and including, 3.6.17. The handler only verifies a nonce, but the corresponding `ccb_export_nonce` is broadcast on every wp-admin page (including pages reachable to Subscribers, such as `/wp-admin/profile.php`) by the `ccb_add_admin_nonces` callback hooked to `admin_head`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export every calculator's full configuration - including stored Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys. CVE record
- CVE-2026-10865, 11 Jul 2026
- The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings. CVE record
- CVE-2025-14755, 13 May 2026
- The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR) in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator Builder PRO. This is due to the ccb_woocommerce_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the renderWooCommercePayment() function passing user-controlled data directly to CCBWooCheckout::init() without authorization checks. This makes it possible for unauthenticated attackers to add WooCommerce products to their cart with attacker-controlled prices. CVE record
- CVE-2025-14757, 16 Jan 2026
- The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccb_nonces in the page source, any unauthenticated attacker can mark any order's payment status as "completed" without actual payment. CVE record
- CVE-2025-12529, 2 Dec 2025
- The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() function in all versions up to, and including, 3.6.3. This makes it possible for unauthenticated attackers to inject arbitrary file paths into the orders that are removed, when an administrator deletes them. This can lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability requires the Cost Calculator Builder Pro version to be installed along with the free version in order to be exploitable. CVE record
- CVE-2025-9243, 4 Oct 2025
- The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and update_order_status functions in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access order management functions and modify order status. CVE record
- CVE-2025-2128, 11 Apr 2025
- The Cost Calculator Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_ids’ parameter in all versions up to, and including, 3.2.67 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE record
- CVE-2024-10892, 18 Dec 2024
- The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. CVE record
- CVE-2024-8379, 30 Sep 2024
- The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin. CVE record
- CVE-2024-6010, 7 Sep 2024
- The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin allowing the price field to be manipulated prior to processing via the 'create_cc_order' function, called from the Cost Calculator Builder plugin. This makes it possible for unauthenticated attackers to manipulate the price of orders submitted via the calculator. Note: this vulnerability was partially patched with the release of Cost Calculator Builder version 3.2.17. CVE record
- CVE-2024-6011, 2 Jul 2024
- The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2024-6012, 2 Jul 2024
- The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary posts and append arbitrary content to existing posts. CVE record
- CVE-2024-4097, 2 May 2024
- The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including, 3.1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
What to do if you run Cost Calculator Builder
If you run Cost Calculator Builder, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Cost Calculator Builder vulnerabilities
Free. We email you when a new vulnerability is published for Cost Calculator Builder, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.