{"uuid": "18f4f3b2-b69a-479c-bced-dd7b7643a37b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-24904", "type": "seen", "source": "https://t.me/hacking_Attack/40438", "content": "Exploit Collector\nWordPress Mortgage Calculators WP 1.52 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png \nWordPress Mortgage Calculators WP plugin version 1.52 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 244a7ae033a33d6c4e56be58e6a7618c\n\nDownload\n# Exploit Title: WordPress Plugin Mortgage Calculators WP 1.52 - Stored Cross-Site Scripting (XSS) (Authenticated)\n# Date: 25-10-2021\n# Exploit Author: Ceylan Bozogullarindan\n# Vendor Homepage: https://lenderd.com/\n# Software Link: https://mortgagecalculatorsplugin.com/\n# Version: 1.52\n# Tested on: Linux\n# CVE : CVE-2021-24904 (https://wpscan.com/vulnerability/7b80f89b-e724-41c5-aa03-21d1eef50f21)\n# Description:\nThe plugin gives users real-time estimates by providing mortgage calculators. It does not implement any sanitisation on the color value of the background of a calculator in admin panel, which could lead to authenticated Stored Cross-Site Scripting issues. An attacker can execute malicious javascript codes for all visitors of a page containing the calculator.\n# Steps To Reproduce:\n1. Go to settings page available under the \"Calculator\" menu item.\n2. Click the \"Select Color\" button and type the following payload the input space: `hacked`\n3. Click the \"Save Changes\" button to save settings.\n4. Create a new page and add the shortcode ([mcwp type=\"cv\"]) of the calculator, for testing.\n5. Visit the page to trigger XSS.\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:58.396577Z"}