The Cost Calculator Builder plugin for WordPress suffers from a stored XSS vulnerability due to insufficient input sanitization and output escaping of the 'textarea.description' parameter. This allows authenticated administrators to inject arbitrary web scripts into pages, which execute upon page access. The vulnerability affects all versions up to and including 3.2.12. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the context of users viewing the injected pages. This can lead to partial disclosure of confidential information and integrity loss. There is no impact on availability. The vulnerability does not appear to be exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider monitoring for suspicious activity related to the 'textarea.description' parameter. Avoid using affected plugin versions if possible.