Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,714 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?EMCost Calculator BuilderStylish Cost CalculatorCost CalculatorCost Calculator for ElementorProject Cost CalculatorCost Calculatorstylish-cost-calculator-premium
Plugin · stylish-cost-calculator
Stylish Cost Calculator
4 known vulnerabilities on record. Add your version above to see which ones affect you.
Jun 26, 2026Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.CVE-2026-54847 · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.
Jan 23, 2026Stylish Cost Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-24630 · affects up to 8.2.9 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows Stored XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.2.9.
Nov 21, 2025Stylish Cost Calculator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-66091 · affects up to 8.1.5 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows DOM-Based XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.1.5.
Nov 29, 2021Stylish Cost Calculator: Does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users)CVE-2021-24822 · fixed in 7.0.4 · reported by WPScanMedium 5.4
The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.