Cost Calculator Builder
Approved changes feed: RSS · Atom
cpe:2.3:a:stylemix:cost_calculator_builder:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Stylemix (c2170171-f70b-5bf4-89aa-da5048b14251) |
|---|---|
| Product | Cost Calculator Builder (b0835b2d-2439-5f6b-b6d1-5cb50e04b136) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-7753 |
vulnerable | 2026-09-16 04:34:11.021856 |
Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure
MEDIUM (6.5)
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculator-custom-export-run` AJAX action (handler `CCBExportImport::export_calculators()`) in all versions up to, and including, 3.6.17. The handler only verifies a nonce, but the corresponding `ccb_export_nonce` is broadcast on every wp-admin page (including pages reachable to Subscribers, such as `/wp-admin/profile.php`) by the `ccb_add_admin_nonces` callback hooked to `admin_head`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export every calculator's full configuration — including stored Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys.
Published: 2026-08-05T05:27:37.774Z
Updated: 2026-08-05T14:27:26.542Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-10865 |
vulnerable | 2026-07-29 00:23:30.737895 |
Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys
MEDIUM (5.3)
The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.
Published: 2026-07-11T05:35:46.548Z
Updated: 2026-07-13T17:35:45.659Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9243 |
vulnerable | 2026-06-08 07:45:21.987112 |
Cost Calculator Builder <= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions
HIGH (8.1)
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and update_order_status functions in all versions up to, and including, 3.5.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access order management functions and modify order status.
Published: 2025-10-04T02:24:36.330Z
Updated: 2026-04-08T17:14:22.077Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-62049 |
vulnerable | 2026-06-08 07:37:28.582683 |
WordPress Cost Calculator Builder plugin <= 3.5.32 - Broken Access Control vulnerability
MEDIUM (6.5)
Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through <= 3.5.32.
Published: 2025-11-06T15:55:44.281Z
Updated: 2026-04-28T16:14:00.166Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-48277 |
vulnerable | 2026-06-08 07:27:15.644094 |
WordPress Cost Calculator Builder plugin <= 3.2.74 - Cross Site Scripting (XSS) Vulnerability
MEDIUM (5.9)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder allows Stored XSS.This issue affects Cost Calculator Builder: from n/a through <= 3.2.74.
Published: 2025-05-19T14:45:26.444Z
Updated: 2026-04-28T16:12:55.322Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-39587 |
vulnerable | 2026-06-08 07:23:06.804374 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-31414 |
vulnerable | 2026-06-08 07:17:02.975990 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2128 |
vulnerable | 2026-06-08 07:14:58.060772 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14757 |
vulnerable | 2026-06-08 07:06:35.104027 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-14755 |
vulnerable | 2026-06-08 07:06:35.100929 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12529 |
vulnerable | 2026-06-08 07:04:30.376970 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6012 |
vulnerable | 2026-06-08 06:58:17.193969 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6011 |
vulnerable | 2026-06-08 06:58:17.192506 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-40011 |
vulnerable | 2026-06-08 06:09:41.019940 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.