CVE-2021-24828: Mlcalc Mortgage Calculator/loan Calculator

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks

Affected products

• Mlcalc Mortgage Calculator/loan Calculator: before 1.5.17 (fixed in 1.5.17)

Published 2022-01-03. Last modified 2026-06-17.