Critical severity · published Aug 29, 2024
CVE-2024-43144
WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability
9.8
CVSS
2%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Cost Calculator Builder allows SQL Injection.This issue affects Cost Calculator Builder: from n/a through 3.2.15.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Cost Calculator Builder · StylemixThemes
through 3.2.15 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-43144
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-43144
Third Party Advisory
https://patchstack.com/database/vulnerability/cost-calculator-builder/wordpress-cost-calculator-builder-plugin-3-2-15-sql-injection-vulnerability?_s_id=cve
More from Cost Calculator Builder
7.5
CVE-2026-97307
WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability
7.2
CVE-2024-8379
Cost Calculator Builder < 3.2.29 - Admin+ SQL Injection
5.4
CVE-2024-10892
Cost Calculator Builder < 3.2.43 - Settings update via CSRF
5.4
CVE-2023-40011
WordPress Cost Calculator Builder plugin <= 3.1.42 - Broken Access Control vulnerability
5.3
CVE-2025-14757
Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass