The vulnerability CVE-2025-47476 in Cost Calculator for Elementor plugin arises from improper input neutralization during web page generation, resulting in a DOM-based XSS flaw. This vulnerability affects all versions up to 1.3.3. An attacker with low privileges can exploit this issue if a user interacts with crafted content, potentially leading to limited compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 6.5, indicating medium severity. The vulnerability is not related to a cloud service and no patch or vendor advisory is currently available.

Exploitation of this DOM-based XSS vulnerability can lead to limited disclosure of information, modification of data, and disruption of service within the context of the affected web application. The attacker requires user interaction and low privileges to exploit this issue. There are no known active exploits in the wild, and the impact is rated medium severity based on the CVSS score of 6.5.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input that interacts with the affected plugin and apply web application firewall (WAF) rules to detect and block potential XSS payloads. Monitor vendor channels for updates and apply patches promptly once released.