CVE-2026-10865— Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| stylemix | Cost Calculator Builder | ≤ 4.0.11 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-10865
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息暴露
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| stylemix | Cost Calculator Builder | 0 ~ 4.0.11 | - |
II. Public POCs for CVE-2026-10865
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10865
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-10865 (6)
Other References for CVE-2026-10865 (1)
IV. Related Vulnerabilities
Same product: Cost Calculator Builder
- CVE-2025-14755
Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Man - CVE-2025-14757
Cost Calculator Builder <= 3.6.9 - Missing Authorization to - CVE-2025-12529
Cost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary - CVE-2025-62049
WordPress Cost Calculator Builder plugin <= 3.5.32 - Broken - CVE-2025-9243
Cost Calculator Builder <= 3.5.32 - Authenticated (Subscribe
Same vendor: stylemix
- CVE-2026-13114
Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Script - CVE-2026-12435
Motors <= 1.4.111 - Missing Authorization to Authenticated ( - CVE-2026-57330
WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scri - CVE-2026-57640
WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access C - CVE-2026-42730
WordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection v
Same weakness: CWE-200
- CVE-2026-57095
Win32k Elevation of Privilege Vulnerability - CVE-2026-56184
Win32k Information Disclosure Vulnerability - CVE-2026-50681
Windows Secure Channel Information Disclosure Vulnerability - CVE-2026-50483
Windows Graphics Component Information Disclosure Vulnerabil - CVE-2026-50415
Windows Media Information Disclosure Vulnerability
V. Comments for CVE-2026-10865
No comments yet