This vulnerability in Stylemix Cost Calculator Builder (<= 3.2.74) allows stored cross-site scripting due to improper input neutralization during web page generation. An attacker with high privileges and requiring user interaction can inject malicious scripts that persist and execute in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low complexity, high privileges required, and user interaction needed with scope changed.

Successful exploitation can lead to execution of malicious scripts in the context of affected users, potentially resulting in partial disclosure of information, modification of data, and limited disruption of service. The requirement for high privileges and user interaction reduces the likelihood of exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin to trusted users only and monitor for suspicious activity. Avoid granting unnecessary high privileges to users of the Cost Calculator Builder plugin.