Stored Cross-Site Scripting Vulnerability in EM Cost Calculator Plugin for WordPress

CVE-2026-2506

What is CVE-2026-2506?

The EM Cost Calculator plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability, affecting all versions up to 2.3.1. This flaw arises because the plugin improperly handles user input by storing attacker-controlled 'customer_name' data and failing to appropriately escape it when displayed in the admin customer list. As a result, unauthenticated malicious actors can inject arbitrary web scripts. These scripts execute in the context of the administrator's browser upon viewing the EMCC Customers page, potentially compromising admin sessions and allowing attackers to perform unauthorized actions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References